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Executive  Summary 


Terrorist  organizations  are  not  static  entities.  They  learn,  change  their  structure,  adapt  to 
countermeasures,  and  continuously  look  for  means  to  advance  their  campaign.  Sometimes  the 
terrorists’  efforts  result  in  successful  operations;  sometimes  they  lead  to  failure. 

The  purpose  of  this  study  is  to  identify  particular  factors  which  influence  the  success  or  failure  of 
terrorist  plots.  This  is  the  second  of  a  two  phased  effort:  Phase  I  focused  on  assessing  the 
underlying  reasons  for  the  success  and  failure  of  terrorist  attacks  against  targets  within  the  United 
States  and  against  U.S.  interests  abroad. 

Phase  II,  this  study,  focuses  on  attacks  since  the  mid-1990s  against  targets  in  the  United  States 
and  abroad,  whether  or  not  directly  targeting  the  United  States.  We  look  at  two  target  categories 
that  we  believe  are  particularly  vulnerable:  passenger  rail  and  commercial  aviation.  Using  a  case 
study  analysis,  we  identified  eight  particular  terrorist  attacks  to  analyze.  These  are: 

Passenger  Rail: 

•  The  Aum  Shinrikyo  attack  on  Japanese  subway  trains,  March  20,  1995 

•  The  suicide  bombing  plot  involving  the  New  York  City  subway  system,  July  1997 

•  The  attacks  on  the  London  transit  system,  July  7,  2005 

•  The  plan  to  attack  the  London  transit  system,  July  21,  2005 
Commercial  Aviation 

•  The  hijacking  of  Air  France  Flight  8969,  December  24-26,  1994 

•  The  Bojinka  plot  in  the  Philippines,  December  1994  -  January  1995 

•  The  attacks  of  September  1 1 ,  200 1 

•  The  plot  to  destroy  U.S.  airliners  with  liquid  explosives,  August  2006 

We  analyzed  these  cases  based  on  an  expansion  of  the  set  of  factors  used  in  Phase  I  (see 
Appendix  A  for  a  detailed  description  of  factors  and  methodology).  The  results  were  then 
examined  as  a  group  to  discern  trends  and  commonalities. 

Findings 

The  analytic  results  indicated  that  the  most  influential  factors  determining  the  success  or  failure 
of  a  terrorist  attack  are  those  that  occur  in  the  pre-execution  phases.  While  safeguards  and 
controls  at  airports  and  rail  stations  are  critical,  they  are  most  effective  when  coupled  with  factors 
that  can  be  leveraged  to  detect  the  plot  in  the  planning  stages.  These  factors  include: 

•  Poor  terrorist  operational  security  (OPSEC).  The  case  studies  indicate  that  even  plots 
that  are  otherwise  well-planned  and  operationally  sound  will  fail  if  there  is  a  lack  of 
attention  to  OPSEC.  Security  services  cannot  “cause" poor  OPSEC,  but  they  can  create 
the  proper  conditions  to  capitalize  on  it  when  it  occurs. 

•  Obsen’ant  public  and  vigilant  security  sendees.  OPSEC  breaches  are  a  significant  factor 
only  if  they  are  noticed.  In  cases  where  the  public  was  sensitive  to  suspicious  behavior, 
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lapses  in  OPSEC  were  brought  to  the  attention  of  authorities  by  ordinary  citizens. 
However,  the  authorities  must  likewise  be  vigilant  and  recognize  the  value  of  unexpected 
information  that  may  seem  unimportant,  but  actually  provides  the  opening  to  interdict  a 
planned  attack. 

•  Terrorist  profile  indicators.  Awareness  of  and  sensitivity  to  behavioral  indicators,  certain 
activities,  or  past  involvement  with  extremist  elements  can  help  alert  an  observant  public 
and  help  a  vigilant  security  apparatus  recognize  a  potential  cell  of  terrorist  plotters. 

•  Law  enforcement  or  intelligence  information  sharing.  Naturally,  if  security  services  are 
aware  of  an  impending  attack  they  will  be  better  able  to  interdict  it.  The  key,  as  stated 
above,  is  to  recognize  the  value  of  information  that  may  seem  unimportant  but  warrants 
further  investigation.  Security  services  may  not  recognize  the  context  into  which  a  certain 
piece  of  information  fits,  but  by  sharing  with  other  organizations  more  parts  of  the  puzzle 
can  be  pieced  together.  Information  should  be  shared  laterally,  with  counterpart 
organizations;  downward,  with  local  law  enforcement,  who  can  serve  as  collectors  of 
information;  and  with  higher  elements  capable  of  conducting  detailed  analysis. 
Intelligence  collection  and  analysis  are  relatively  new  functions  for  law  enforcement. 
Training  is  a  key  element  in  their  ability  to  recognize  and  respond  to  indicators. 

•  International  cooperation.  Nearly  all  terrorist  plots,  including  most  of  those  studied  for 
this  project,  have  an  international  connection.  This  could  include  overseas  support 
elements,  training  camps,  or  movement  of  funds.  The  sharing  of  information  among  allies 
appears  from  our  analysis  to  have  a  positive  impact  on  interdicting  attack  plans  as  well  as 
apprehending  members  of  larger  networks. 

Policy  Implications 

One  phenomenon  stands  out:  terrorists  are  rarely  caught  in  the  act  during  the  execution  phase  of 
an  operation,  other  than  instances  in  which  their  equipment  or  weapons  fail.  Rather,  plots  are 
most  often  foiled  during  the  pre-execution  phases.  The  importance  of  detecting  and  interdicting 
terrorist  plans  early  leads  to  several  implications  for  policy. 

We  found  that  there  must  be  an  observant  and  sensitive  public  that  recognizes  potential  indicators 
of  terrorist  planning.  Therefore,  public  awareness  programs  aimed  at  the  general  populace, 
combined  with  outreach  activities  focused  on  at-risk  populations,  are  key  to  creating  an 
environment  which  can  detect  and  report  OPSEC  lapses.  This  effectively  creates  a  wider 
surveillance  net  for  reporting  potential  attack  planning.  Additionally,  the  security  apparatus 
should  be  knowledgeable  and  sensitive  to  reports  and  other  indicators  that  may  be  signs  of 
terrorist  planning.  This  involves  training  of  officers  at  the  lowest  echelons  and  sufficient 
resources  to  allow  all  pertinent  leads  to  be  investigated. 

Community  policing  has  the  potential  of  increasing  both  the  sensitivity  of  the  public  and  the 
awareness  of  law  enforcement  personnel.  Police  who  are  embedded  within  communities  know — 
and  are  known  by — the  residents.  Observant  citizens  are  more  likely  to  approach  such  police 
officers  with  information  regarding  suspicious  activity. 

Information  must  be  shared  both  horizontally  and  vertically.  Police  and  security  services  need  to 
have  open  conduits  of  information  exchange  with  their  foreign  counterparts  due  to  the  mobility 
and  globalization  of  the  terrorist  threat.  Further,  they  must  be  able  to  share  information  upward. 
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where  disparate  pieces  of  information  can  be  woven  together,  and  downward,  where  information 
can  be  used  to  inform  enforcers  of  threats  of  which  they  should  be  aware. 

The  important  lesson  learned  is  that  it  is  highly  effective  to  concentrate  on  the  pre-execution 
phases  of  attempted  terrorist  attacks.  Last-line  fail-safe  measures  are  critical  to  thwart  undetected 
plots,  as  well  as  induce  uncertainty  into  the  terrorist  planning  process.  However,  the  best  way  to 
influence  the  success  or  failure  of  an  attack — at  the  tactical,  operational,  or  strategic  level — is  to 
interdict  the  plot  before  the  terrorists  deploy  to  execute  their  plan. 
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Section  I — Background 


Introduction 

The  Department  of  Homeland  Security  (DHS),  and  more  generally  the  homeland  security 
community,  faces  the  daunting  challenge  of  anticipating  and  preventing  attacks  by  innovative, 
adaptive  enemies.  These  adversaries  may  have  a  track  record  of  success  but  they  may  also  have 
suffered  failures  for  a  variety  of  reasons. 

It  is  not  always  clear  what  leads  to  the  failure  of  terrorist  groups  to  carry  out  their  attacks.  In  some 
instances,  it  seems  to  be  bad  luck,  rather  than  positive  action  by  security  authorities;  at  other 
times,  credit  clearly  goes  to  intelligence,  law  enforcement,  and  protective  services. 

Identifying  the  factors  underlying  the  success  or  failure  of  terrorist  plans  will  greatly  facilitate  the 
ability  of  DHS  to  formulate  strategy  and  allocate  resources  in  a  way  that  maximizes  its  ability  to 
prevent  attacks  from  occurring  or  to  mitigate  the  consequences.  The  purpose  of  this  study  is  to 
assist  DHS,  and  others  involved  in  preventing  terrorist  attacks,  by  identifying  such  factors  and 
relating  the  findings  to  possible  policy  implications.  We  have  done  so  by  applying  case  study 
analytical  methods  to  a  number  of  successful  and  unsuccessful  terrorist  plots,  which  were  selected 
based  on  how  well  they  demonstrate  key  aspects  of  planning  and  executing  terrorist  attacks. 

Who  Should  Read  This  Study 

Several  communities  could  benefit  from  the  information  presented  in  this  report.  These  include: 

•  Policymakers  in  the  Department  of  Homeland  Security  and  its  components 

•  Officials  involved  with  security  of  transit  and  aviation  systems  at  the  federal,  state  and 
local  levels 

•  Law  enforcement  personnel 

•  Decisionmakers  responsible  for  allocation  of  resources  in  the  homeland  security, 
intelligence,  and  law  enforcement  communities 

•  Intelligence  analysts 

•  Scholars  interested  in  the  historical  antecedents  to  current  and  future  terrorist  attacks 

It  is  our  hope  that  the  analysis  presented  in  this  report  is  useful  to  these  communities  and  others 
interested  in  protecting  the  U.S.  and  its  allies  from  terrorist  attack.  We  further  hope  that  our 
research  leads  to  discussion  among  the  many  stakeholders  in  this  important  area  and  serves  as  a 
catalyst  for  continued  research. 


5 


Underlying  Reasons  for  Success  and  Failure  of  Terrorist  Attacks 


Methodology 

This  Homeland  Security  Institute  project  represents  Phase  II  of  Underlying  Reasons  for 
Successful  &  Unsuccessful  Terrorist  Attacks  Against  the  U.S.  Homeland  &  Selected  U.S.  Interests 
Abroad.  Phase  I,  completed  in  September  2005,  sought  to  create  a  historical  record  of  terrorist 
incidents  directed  against  the  United  States  or  its  interests,  as  well  as  to  determine  what  accounts 
for  the  success  or  failure  of  an  attack. 

For  this  phase,  we  expanded  upon  Phase  I  of  this  project  by  including  attacks  or  attempted  attacks 
against  both  U.S.  and  non-U.S.  targets.  For  that  reason,  the  words  “Against  the  U.S.  Homeland 
and  Selected  U.S.  Interests”  were  removed  from  the  title.  In  addition,  Phase  II  attempts  to  discern 
various  aspects  and  factors  of  success  or  failure  from  both  the  U.S./Westem  and  the  adversarial 
perspectives. 

Phase  I  focused  on  factors  called  terrorist  objectives,  operational  measures  (such  as  training, 
technical  proficiency,  deception,  or  operational  security),  and  environmental  measures  (such  as 
target  accessibility,  countermeasures,  or  permissive  environment).  In  the  current  phase,  we 
expanded  upon  these  factors  using  a  matrix  adapted  from  an  attack  path  risk  model  (described 
below). 

Phase  I  identified  underlying  reasons  for  success  and  failure.  Reasons  for  success  included 
accessibility  of  the  target,  execution,  technical  proficiency  or  technology  factors,  personnel,  and 
planning.  Reasons  for  failure  included  personnel,  technical  proficiency  or  technology  factors,  and 
intelligence. 

The  methodology  of  Phase  I  centered  on  the  compilation  of  a  large  database  of  cases,  from  which 
statistical  inferences  were  drawn.  Phase  II  narrows  the  focus  to  a  smaller  set  of  informative, 
representative  cases  and  uses  case  study  methodology  to  elicit  executable  information. 

In  this  phase,  Phase  II,  we  examine  “success”  and  “failure”  from  the  adversary’s  perspective  at 
tactical,  operational,  and  strategic  levels.  For  the  purpose  of  this  study,  those  levels  are  defined  as 
follows: 

•  Tactical:  Immediate  damage  from  a  weapon  or  other  method  of  attack  —  for  example, 
casualties  and  material  damage  due  to  the  effects  of  the  weapon 

•  Operational:  Systemic  disruption,  widespread  media  attention,  or  other  effects  lasting 
weeks  or  months 

•  Strategic:  Lasting  effects  enabling  terrorists  to  achieve  long-term  goals,  such  as  changes 
in  foreign  or  domestic  policy  that  aid  their  cause  or  long-term  economic  or  psychological 
damage 

The  consequences  of  the  attacks  of  September  11,  2001  provide  a  useful  illustration  of  the 
tactical,  operational,  and  strategic  levels.  The  nearly  3000  deaths  and  physical  destruction  of  the 
aircraft,  Twin  Towers  and  Pentagon  can  be  considered  tactical  level  effects.  The  extensive  media 
coverage  and  systemic  disruption  of  air  traffic  control  over  the  next  few  days  and  weeks  are 
operational  level  effects.  Continuing  economic  and  psychological  effects  on  the  American 
population  are  considered  strategic  effects. 

For  data  evaluation  purposes,  we  created  three  matrices  to  evaluate  each  case  systematically  so 
that  possible  trends  and  patterns  could  be  identified.  The  first  (Attack  Path  Matrix)  breaks  down 
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the  event  into  the  steps  required  to  plan  and  execute  the  attack  (see  Appendix  A,  p.  102).  The 
second  (  Success  Indicator  Matrix)  analyzes  indicators  of  success  or  failure  at  the  tactical, 
operational,  and  strategic  levels,  and  is  divided  into  pre-execution  and  execution  phase  factors 
(see  Appendix  A,  p.  103).  These  indicators  determine  the  degree  to  which  an  attack  or  attempt 
was  successful  at  each  of  the  three  levels.  It  is  possible  for  an  attack  to  have  the  attributes  of 
success  at  some  levels  and  attributes  of  failure  at  others.  The  final  matrix  (Factors  Matrix) 
examines  factors  that  our  analysis  indicates  have  an  impact  on  the  success  or  failure  of  an 
operation;  in  other  words,  the  first  matrix  shows  the  “how,”  the  second  matrix  shows  the  “what,” 
and  the  third  depicts  the  “why”  (see  Appendix  A,  p.  95). 

We  focused  our  efforts  on  two  target  types:  passenger  rail  and  commercial  aviation.  While  there 
are  other  target  categories  (e.g.,  maritime,  fixed  target,  or  industrial  infrastructure),  these  two 
stood  out  because  of: 

•  Demonstrated  terrorist  intent  to  attack  these  targets 

•  Demonstrated  terrorist  capability  to  conduct  such  attacks 

•  Potential  for  mass  casualties 

•  Particular  aspects  inherent  in  the  design  of  these  targets  which  could  impact  the  success 
or  failure  of  attempted  attacks 

We  established  criteria  for  selecting  cases  used  in  this  study  to  determine  which  are  most 
informative  for  future  policy  and  strategy.  The  criteria  are  described  in  detail  in  Appendix  A. 
These  criteria  are: 

•  Is  there  evidence  of  clear  ties  to  a  terrorist  plan? 

•  Does  the  incident  demonstrate  terrorist  learning,  either  as  precedent  or  refinement  of 
prior  tactics? 

•  Does  the  incident  demonstrate  some  aspect  (e.g.,  tactic,  group  characteristic,  target)  that 
is  believed  to  be  a  significant  threat  in  the  future? 

•  Does  the  incident  demonstrate  any  particularly  informative  counterterrorism  approaches? 

•  Does  the  incident  demonstrate  a  significant  shift  in  terrorist  trends? 

We  selected  eight  cases  for  in-depth  study  to  gain  a  more  complete  understanding  of  the 
components  of  the  incident  and  factors  that  led  to  success  or  failure  at  multiple  levels — tactical, 
operational,  and  strategic.  We  chose  terrorist  events  that  met  one  or  more  of  the  criteria  and 
which  demonstrated  important  aspects  of  planning  and  executing  terrorist  attacks.  These  cases  are 
described  briefly  below  and  in  detail  later  in  the  main  body  of  the  report. 

Passenger  Rail 

1.  Aum  Shinrikyo  attack  on  Japanese  subway  trains,  March  20,  1995.  Although  this 
event  occurred  over  a  decade  ago,  it  remains  highly  informative.  This  incident 
demonstrates  one  of  the  only  terrorist  attacks  to  use  chemical  weapons  with  a  modicum 
of  success.  This  event  is  also  one  of  the  first  terrorist  attacks  on  trains  or  subways;  as 
such,  it  illustrates  possible  terrorist  organizational  learning  for  future  attack  planning. 
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2.  Suicide  bombing  plot,  New  York  City  subway  system,  July  1997.  While  this  plot 
never  reached  the  execution  phase,  trains — especially  high-volume  urban  subway 
systems — are  particularly  vulnerable  and  attractive  targets  to  terrorists.  While  there 
have  been  other  similar  attempts  (many  successful)  overseas,  this  case  is  of  interest 
because  it  involved  a  system  in  the  United  States. 

3.  Attacks  on  the  London  transit  system,  July  7,  2005.  This  successful  series  of  attacks 
suggests  that  attacks  on  rail  systems  pose  a  significant  future  threat.  This  case  is 
instructive  due  to  significant  similarities  between  London  mass  transit  and  mass  transit 
systems  across  the  United  States.  It  also  demonstrates  potential  terrorist  organizational 
learning,  building  upon  similar  events  in  Madrid  and  elsewhere.  Furthermore,  the  case 
displays  a  shift  in  terrorist  trends  toward  the  use  of  attackers  who  were  bom  and  raised 
in  the  target  country. 

4.  Plan  to  attack  the  London  transit  system,  July  21, 2005.  This  unsuccessful  attempt 
occurred  only  two  weeks  after  the  successful  attack  and  against  the  same  target  system. 
It  is  useful  to  contrast  this  case  with  the  successful  attacks  of  July  7,  2005.  The  case 
demonstrates  potential  terrorist  organizational  learning,  although  in  this  case,  perhaps  a 
failure  to  do  so. 

Commercial  Aviation 

1.  Air  France  Flight  8969,  December  1994.  In  this  case,  terrorists  from  the  Armed 
Islamic  Group  successfully  entered  the  execution  phase  by  hijacking  an  airliner  and 
forcing  it  to  fly  to  France.  The  case  exhibits  a  precedent  for  terrorist  organizational 
learning.  It  was  the  first  planned  attempt  to  use  a  commercial  aircraft  as  a  weapon  in 
and  of  itself,  and  subsequent  efforts,  such  as  the  attacks  of  September  1 1 ,  may  have 
been  informed  by  mistakes  made  by  the  terrorists  that  prevented  them  from  ultimately 
reaching  their  target.  The  case  also  demonstrates  successful  counterterrorism  methods: 
although  the  terrorists  succeeded  in  entering  the  execution  phase,  counterterrorist  forces 
were  able  to  free  all  hostages. 

2.  The  Bojinka  Plot,  December  1994-January  1995.  This  plot  had  several  elements:  an 
attempt  to  kill  Pope  John  Paul  II  in  Manila,  a  plan  to  crash  an  aircraft  into  the 
headquarters  of  the  Central  Intelligence  Agency,  and  an  effort  to  simultaneously  destroy 
1 1  or  12  U.S.-flag  airliners  in  flight  over  the  Pacific  Ocean.1  None  of  these  components 
reached  the  execution  phase.  This  case  illustrates  potential  terrorist  organizational 
learning  as  a  precedent.  It  was  the  first  attempt  to  destroy  multiple  airliners 
simultaneously  in  flight,  it  was  the  first  significant  attempt  to  use  liquid  explosives  to 
circumvent  existing  screening  technology,  and  (like  the  Air  France  plot)  it  was  an  early 
attempt  to  use  an  aircraft  as  a  weapon  by  crashing  it  into  a  target. 

3.  The  attacks  of  September  11,  2001.  A1  Qaeda  succeeded  in  entering  the  execution 
phase  of  this  plan,  using  four  commandeered  airliners  to  destroy  targets  of  significant 
symbolic  and  material  value  and  kill  nearly  3,000  Americans.  This  case  exhibits 
organizational  terrorist  learning,  with  commercial  aircraft  being  used  as  weapons 
successfully  for  the  first  time.  It  also  demonstrates  a  significant  shift  in  terrorist  and 
counterterrorist  trends:  not  only  was  it  the  largest,  most  complex  terrorist  attack  on  U.S. 
soil  to  date,  but  it  led  to  major  changes  in  security  measures. 
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4.  The  plot  to  destroy  U.S.  airliners  with  liquid  explosives,  August  2006.  British 
authorities  successfully  prevented  a  group  of  approximately  20  terrorists  from 
destroying  multiple  U.S. -flag  airliners  en  route  from  the  United  Kingdom  to  the  United 
States.  The  case  illustrates  terrorist  organizational  learning:  like  the  Bojinka  plot,  this 
plan  called  for  the  use  of  liquid  explosives.  The  method  for  smuggling  the  explosives  on 
board  was  more  sophisticated  than  in  the  Bojinka  plot.  The  use  of  liquid  explosives  also 
exhibits  a  significant  shift  in  terrorist  trends,  in  that  it  has  forced  a  major  adjustment  to 
screening  procedures  for  commercial  aircraft.  Finally,  the  effective  international  and 
interagency  information  sharing  that  disrupted  this  plan  is  a  useful  “lessons  learned.” 

A  Note  on  Cases  Not  Selected  for  This  Study 

In  choosing  cases  for  analysis,  we  avoided  incidents  that  were  redundant.  For  example,  the 
bombings  in  Madrid  were  significant  in  that  they  affected  an  election.  We  reviewed  this  incident 
for  inclusion  in  the  study,  but  in  its  technical  execution  we  found  it  to  be  similar  to  the  London 
bombings  of  July  7,  2005.  Between  the  two,  we  decided  to  study  the  London  incident  because: 

•  It  provided  a  useful  vehicle  for  contrast  against  the  unsuccessful  plot  of  July  21,  2005, 
and 

•  The  London  Underground  system  is  more  analogous  to  U.S.  urban  subway  systems  than 
Madrid’s  commuter  rail,  which  is  more  typical  of  the  large-scale  passenger  networks  on 
the  European  continent 

For  similar  reasons,  we  did  not  include  the  attacks  by  Islamic  terrorists  in  Mumbai  in  July  2006  or 
by  Chechen  terrorists  in  Moscow  in  February  2004.  However,  where  appropriate,  we  refer  to 
these  incidents  to  expand  upon  information  presented  in  our  other  case  studies. 

A  more  detailed  description  of  the  methodology  used  in  this  study  is  found  in  Appendix  A. 
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Section  II — Passenger  Rail 


Specific  Vulnerabilities  of  Passenger 
Rail  Systems 

Before  examining  specific  case  studies  on  attacks  or  attempted  attacks  on  the  passenger  rail 
sector,  it  is  useful  to  identify  aspects  of  these  systems  that  affect  the  ability  of  terrorists  to  conduct 
successful  attacks  on  passenger  trains  and  subways. 

Limited  Screening  Capability  and  Open  Architecture  of  Rail 

Systems 

Compared  to  other  categories  of  targets,  such  as  those  in  the  aviation  sector,  passenger  rail 
presents  unique  challenges  to  security  screening.  This  difficulty  may  provide  greater  opportunity 
for  terrorists  to  attack  targets  within  this  sector. 

One  of  the  reasons  that  screening  rail  passengers  is  difficult  relates  to  the  open  architecture  of  the 
system.2  By  design,  rail  systems  are  accessible  and  are  therefore  more  challenging  to  protect.  In 
many  cases,  trains  and  subways  must  move  large  volumes  of  passengers  who  are  in  a  hurry  to 
arrive  at  their  destinations.  Rail  passenger  facilities  rely  on  the  rapid,  easy  movement  of 
customers  on  and  off  of  trains  and  in  and  out  of  stations.  2 

Any  type  of  thorough  screening  would  add  time  to  passengers’  commutes,  and  this  could  make 
rail  an  inconvenient  option  for  many  commuters.  If  strict  screening  measures  were  instituted 
system-wide,  the  cost  of  the  security  likely  would  be  reflected  in  higher  fares  for  customers, 
which  also  might  result  in  decreased  ridership. 

Members  of  Aum  Shinrikyo  relied  upon  the  open  architecture  and  limited  screening  practices  of 
the  Tokyo  subway  system  when  planning  their  March  1995  sarin  gas  attack.  The  openness  of  the 
system  facilitated  their  entry  to  and  exit  from  the  target,  and  they  knew  that  the  sarin  gas  would 
not  be  detected  prior  to  its  release  onboard  the  subway  cars. 

Further,  passenger  rail  systems  transit  diverse  geographical  areas,  moving  through  crowded  urban 
areas,  broad  swaths  of  suburbs,  and  relatively  unpopulated  rural  areas.4  Each  region  presents  its 
own  challenges  to  rail  security.  Large  cities  tend  to  have  high  concentrations  of  stations,  meaning 
that  terrorists  would  have  multiple  opportunities  to  attack  and  have  several  points  of  exit,  should 
they  choose  to  escape  the  train  or  subway  rather  than  conduct  a  suicide  attack. 

In  less  populated  areas,  long  segments  of  track  pass  through  areas  that  are  difficult  to  patrol 
regularly — this  offers  opportunities  for  terrorists  who  might  try  to  lay  explosives  on  the  track  or 
on  bridges.  Were  an  improvised  explosive  device  to  be  detonated  along  a  bridge  or  section  of 
track  on  which  a  train  was  traveling  at  high  speed,  the  force  of  the  explosion  could  cause  the  train 
to  derail,  resulting  in  a  high  number  of  casualties  and  significant  structural  damage,  both  to  the 
train  and  the  tracks  beneath  it.5 

The  limited  screening  capability  and  open  architecture  that  characterize  the  rail  system  have  been 
contributing  factors  to  the  success  of  terrorist  attacks  against  targets  in  this  sector,  including  the 
coordinated  explosions  that  occurred  on  trains  in  Madrid,  Spain,  on  March  11,  2004.  In  this 
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operation,  Moroccan  men,  affiliated  with  or  inspired  by  al  Qaeda,  nearly  simultaneously 
detonated  explosives  on  10  commuter  rail  cars  during  morning  rush  hour.6  The  explosives  were 
hidden  inside  backpacks  and  left  on  board  trains  and  then  detonated  with  mobile  phones,  killing 
191  commuters  and  wounding  1,500  others.7  One  reason  this  attack  is  notable  is  that  it  appears  to 
have  had  significant  effect  at  the  strategic  level.  The  attack  occurred  just  three  days  before 
Spain’s  general  elections  and  seems  to  have  shifted  the  expected  results.  The  Socialist  candidate, 
who  was  not  favored  in  polls  taken  in  the  days  just  before  the  attacks,  won  a  surprising  majority 
of  the  votes;  it  had  appeared  prior  to  the  train  bombings  that  the  sitting  prime  minister,  Jose  Maria 
Aznar,  of  the  right-centrist  Popular  Party,  would  claim  victory.8 

Design  of  Train  Stations  and  Rail  Cars 

The  enclosed  structure  of  some  rail  stations  and  of  train  cars  may  make  them  appealing  targets  to 
terrorists.  Train  stations  are  often  very  crowded,  especially  at  rush  hour,  and  the  high 
concentration  of  people  would  likely  result  in  substantial  casualties  should  a  terrorist  detonate  an 
explosive  inside  the  station.9  Many  passenger  rail  stations  are  located  below  ground, 
concentrating  the  effects  of  any  blast  and  complicating  the  arrival  of  first  responders  and  the  exit 
of  passengers  after  an  attack.10  This  is  exactly  what  occurred  in  the  Kings’s  Cross  Station 
bombing  during  the  attacks  of  July  7,  2005,  in  London,  leading  to  a  large  number  of  injuries  and 
deaths. 

Operational  Predictability 

Passenger  rail  is  among  the  most  predictable  target  categories.  Because  many  trains  are 
patronized  by  commuters  and  other  passengers  on  tight  schedules,  the  trains  must  depart  and 
arrive  at  specific  stations  at  specific  times.  This  aids  terrorists  in  executing  their  plan,  particularly 
if  that  plan  calls  for  multiple,  coordinated  attacks.  Further,  trains  by  nature  cannot  deviate  in  their 
physical  location  to  a  great  degree — their  only  option  is  to  be  at  some  location  on  the  track.  This 
adds  to  the  predictability  of  the  system;  compare  this,  for  example,  to  the  maritime  domain  where 
ships  in  open  water  can  deviate  to  a  significant  extent,  complicating  a  terrorist’s  efforts  to  locate 
and  attack  the  target. 

In  planning  its  operation  against  the  Tokyo  subway  system,  Aum  Shinrikyo  relied  upon  the 
predictable  schedule  of  subway  travel  to  select  specific  targets  for  its  attack.  The  group  chose 
subway  trains  that  would  be  traveling  during  morning  rush  hour,  ensuring  a  high  volume  of 
passengers.  Further,  operatives  selected  trains  that  would  be  simultaneously  converging  upon  a 
centrally  located  and  symbolic  area. 

Summary 

All  of  these  issues — the  limited  screening  capability  that  exists  in  the  passenger  rail  sector,  the 
open  architecture  of  the  passenger  rail  system,  the  design  of  rail  stations  and  passenger  cars,  the 
economic  vulnerabilities,  and  the  operational  predictability — should  be  taken  into  account  when 
considering  the  vulnerabilities  of  this  sector.  Each  of  these  factors  played  a  role  in  the  incidents 
described  in  the  following  case  studies.  In  all  four  cases,  the  terrorists  exploited  the  limited 
screening  capability  and  open  architecture  of  rail  systems.  For  the  majority  of  cases,  they  also 
took  advantage  of  the  vulnerabilities  inherent  in  the  design  of  stations  and  trains  as  well  as  the 
operational  predictability  of  the  system.  In  contrast,  not  all  of  the  cases  demonstrated  exploitation 
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of  the  economic  vulnerabilities  of  the  rail  sector.  The  tables  on  the  following  pages  deconstruct 
the  four  cases  and  display  the  results  for  purposes  of  comparison. 

As  the  following  case  studies  demonstrate,  the  accessibility  and  importance  of  the  passenger  rail 
system  have  made  it  a  desirable  target  for  terrorists  and  may  continue  to  do  so  in  the  future. 
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Table  2-1:  Passenger  Rail  Sector — Indicators  of  Success 
Tactical  Level  Indicators  of  Success 


Case  Study 

Was  the  attackers’ 
security  plan 
maintained  pre¬ 
execution? 

Was  the  attack 
initiated? 

Did  the  weapon(s) 
function  as  designed? 

What  was  the  level  of 
lethality? 

What  was  the  level  of 
injuries  sustained? 

What  was  the  level  of 
material  damage? 

Did  the  cell  members  avoid 
capture/death? 

Sarin  Gas  Attack 

Yes 

Partial 

Partial 

Moderate 

Moderate 

None 

No 

NYC  Subway  Plot 

No 

No 

N/A 

N/A 

N/A 

N/A 

No 

7/7  London  Bombings 

Yes 

Yes 

Yes 

High 

High 

High 

Yes  (suicide) 

7/21  London  Bombings 

Yes 

Yes 

No 

None 

None 

Light 

No 

Operational  Level  Indicators  of  Success 


Case  Study 

Was  the  broader  security 
network  maintained? 

What  was  the  level  of  system 
disruption? 

What  was  the  level  of  media 
coverage? 

Did  the  plot’s  target  have 
symbolic  value? 

Did  the  network  members  avoid 
capture/death? 

Sarin  Gas  Attack 

No 

Minor 

High 

No 

No 

NYC  Subway  Plot 

N/A 

None 

Moderate 

No 

N/A 

7/7  London  Bombings 

Yes 

Moderate 

High 

No 

Yes 

7/21  London  Bombings 

Yes 

Low 

High 

No 

Yes 

Strategic  Level  Indicators  of  Success 


Case  Study 

What  was  the  level  of  psychological 
impact? 

What  was  the  level  of  economic 
impact? 

What  was  the  level  of  policy 
change? 

What  was  the  level  of  impact  on  the 
supporting  population? 

Sarin  Gas  Attack 

High 

Low 

Moderate 

Severe 

NYC  Subway  Plot 

Low 

None 

None 

Unknown 

7/7  London  Bombings 

High 

Moderate 

Moderate 

Severe 

7/21  London  Bombings 

High 

Moderate 

Moderate 

Severe 
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Table  2-2:  Passenger  Rail  Sector — Factors 
Passenger  Rail  Success  Factors — Adversary-Related 


Case  Study 

Factors 

What  was  the  level  of 
the  terrorists’ 
training? 

What  was  the  level  of  the 
terrorists’  technical 
sophistication? 

What  was  the  level  of  the 
terrorists’  operational 
proficiency? 

Were  there  terrorist  profile 
indicators? 

What  was  the  level 
of  terrorist 
OPSEC? 

What  was  the  level  of 
innovation? 

Did  the  terrorists  experience 
any  technical  difficulties? 

Sarin  Gas  Attack 

High 

Moderate 

Moderate 

Low 

High 

High 

Low 

NYC  Subway  Plot 

Moderate 

High 

Unknown 

Moderate 

Low 

Moderate 

None 

7/7  London 

Bombings 

High 

High 

High 

Moderate 

High 

Moderate 

None 

7/21  London 
Bombings 

Low 

Low 

High 

High 

High 

None 

Significant 

Passenger  Rail  Success  Factors — Security-Related 


Case  Study 

Factors 

Was  access  to  the 
target  site  restricted? 

What  was  the  level  of  law 
enforcement  knowledge  of  the  plot? 

Was  the  security 
environment  restrictive? 

What  was  the  level  of  information 
sharing? 

What  was  the  level  of 
international  cooperation? 

What  was  the  level  of 
vigilance  of  the  public  and 
security  services? 

Sarin  Gas  Attack 

No  Barriers 

Moderate 

Permissive 

Low 

Low 

Moderate 

NYC  Subway  Plot 

No  Barriers 

High 

Moderate 

Moderate 

None 

High 

7/7  London  Bombings 

No  Barriers 

None 

Moderate 

Ineffective 

None 

Low 

7/21  London  Bombings 

No  Barriers 

None 

Moderate 

None 

Moderate 

Low 

Table  2-3:  Passenger  Rail  Sector — Case  Study  Descriptions 


PLANNING 

EXECUTION 

Target  Selection 
(Note:  Target,  Method,  and 
Personnel  Selection  can 
occur  in  any  order) 

Method  Selection 

Personnel  Selection 

Intelligence  Gathering  & 
Surveillance 

Logistics,  Resources, 
Materiel,  Support  Network 

Training  (Including 
Rehearsals  &  Dry  Runs) 

Weapon  Assembly 

Stage  for  Attack 

Execute 

Aum  Shinrikyo 
March  1995 

Tokyo  Subway  during  rush 
hour 

Minimal  barriers  to  access 

Sarin  gas  Innovative 

Most  likely  selected  by 
Asahara  or  other  senior 
leader 

None  observed 

Assets  >$1B;  some  training 
through  Russian  groups; 
possible  support  through  co¬ 
opted  Japanese  authorities 

Previous  incident  at 
Matsumoto  served  as  proof 
of  concept 

One  day  prior  to  attack 

Five  attackers  deployed  to 
three  subway  lines;  five 
others  deployed  as 
lookouts/drivers 

Five  devices  activated 

New  York  City 
Subway 

July  1997 

Subway  station  in  Brooklyn 
traveled  by  Jewish  civilians 
Minimal  barriers  to  access 

Two  backpack  bombs 
Probable  suicide 

Unusual,  but  not 
unprecedented 

Unknown  -  most  likely  self¬ 
selection  of  radical 
acquaintances 

Probably  at  least  one 
surveillance  run  -  caught 
jumping  turnstile  at  station 
connected  by  tunnel  to  the 
target. 

Unknown.  Probably  acquired 
materials  during  residence  in 
North  Carolina.  May  have 
been  self-financed. 

No  known  dry  runs  or 
weapons  tests. 

Two  working  weapons 
completely  assembled;  FBI 
confirmed  that  bombs 
would  have  worked  as 
designed. 

Plot  interdicted  prior  to  this 
stage. 

Plot  interdicted  prior  to  this 
stage. 

London 

July  7,  2005 

Three  Underground  trains  and 
one  bus  (unknown  if  bus  was 
intended  target  or  last  minute 
change) 

Minimal  barriers  to  access 

Backpack  bombs/suicide 
Unusual,  but  not 
unprecedented 

Older,  charismatic  leader 
recruited  younger 
radicalized  Moslems 

At  least  one  recon  -  Jun  28, 
by  Khan,  Tanweer  and 
Lindsay;  tickets  found  at  the 
"bomb  factory"  flat  also 
suggest  possible  info 
gathering  in  London  in  mid- 
March 

Apparently  self-financed  (total 
cost  less  than  8K  pounds; 
possibly  AQ  directed, 
inspired,  or  unaffiliated 

Jun  28  may  have  been  a 
dry  run 

Four  weapons  fully 
assembled  (date  unknown) 

Khan,  Tanweer  and 

Hussain  left  in  one  car  from 
Leeds,  and  met  Lindsay  at 
Luton;  then  took  train  to 
King's  Cross,  from  which 
they  transferred  to  Tube 
and  split  up 

3  bombs  nearly 
simultaneously  detonated  at 
rush  hour  4th  on  bus  57 
minutes  later 

London 

July  21, 2005 

Three  Underground  trains  and 
one  bus;  one  unidentified 
target 

Minimal  barriers  to  access 

Backpack  bombs/suicide 
Predictable  following  July  7 
attack 

Appear  to  be  radical 
acquaintances,  all  or  most 
from  Horn  of  Africa 

None  identified;  however,  it 
is  unlikely  they  were  able  to 
deploy  successfully  without 
a  dry  run  beforehand 

Adel  Yahya  apparently  part  of 
support  cell;  calls/text 
messages  to  Saudi  Arabia  for 
hawala 

Unknown;  but  since  the 
weapons  did  not  operate 
due  to  an  apparent  flaw  in 
their  manufacture,  it  is 
unlikely  they  did  a  test  fire 

Five  weapons  fully 
assembled  (date  unknown) 

All  staged  successfully  to 
target  locations 

Four  of  five  attempted  to 
detonate  weapons;  in  those 
four  cases,  the  detonators 
worked  but  main  charge 
failed  due  to  improper 
concentration  of  H202 

16 


Underlying  Reasons  for  Success  and  Failure  of  Terrorist  Attacks 


Chemical  Weapons  Attack  on  the  Tokyo 
Subway  System — March  1995 


Overview 


During  the  peak  of  morning  rush  hour  on  March  20,  1995, 
five  members  of  the  Japanese  religious  cult  Aum  Shinrikyo 
launched  a  sarin  gas  attack  on  multiple  lines  of  the  Tokyo 
subway  system. 

Within  minutes,  more  than  5,000  commuters  and  station 
workers  were  suffering  the  ill  effects  of  the  deadly  nerve 
agent,  and  12  people  were  killed.  Eventually,  several 
members  of  the  organization  were  arrested  for  their  role  in 
this  attack. 


Type  of  Attack:  Sarin  gas  attack 
aboard  five  trains  in  the  Tokyo 
subway  system 

Date:  March  20,  1995,  during  the 
height  of  morning  rush  hour 
Group:  Aum  Shinrikyo,  a  Japanese 
cult  founded  by  Shoko  Asahara  in 
1984 


Significance  of  the  Incident 

Aum’s  attack  on  the  Tokyo  subway  is  the  most  serious  terrorist  incident  in  Japan  in  modem 
history  and  is  one  of  the  few  instances  in  which  terrorists  have  used  chemical  weapons.11  As  more 
recent  violence  in  Madrid,  London,  and  Mumbai  indicates,  terrorists  remain  interested  in 
attacking  the  rail  sector  and  have  the  ability  to  do  so.  The  open  architecture  and  high  ridership 
that  characterize  trains  and  subways  make  them  desirable  targets  for  terrorist  activity. 


This  particular  incident  is  noteworthy  because  it  shows  that  some  terrorist  groups  have  the 
capability  to  manufacture  and  use  chemical  weapons.  Although  rail  attacks  within  the  past  few 
years  have  relied  on  improvised  explosive  devices  rather  than  sarin  or  other  chemical  agents, 
there  is  no  doubt  that  the  possibility  of  biological  or  chemical  weapons  attacks  on  the  U.S. 
transportation  infrastructure  should  be  a  concern.  Therefore,  an  examination  of  the  1995  Aum 
Shinrikyo  case  is  useful  for  providing  information  about  the  threat  that  may  be  posed  to  the  U.S. 
homeland  by  the  possibility  of  similar  attacks. 


Description  of  the  Group  or 
Individuals  Involved 

Founding  of  the  Group  and  Its  Early 
Years 

In  1984,  Shoko  Asahara  founded  Aum  Shinrikyo, 
which  initially  consisted  of  just  1 0  to  15  members 
who  focused  their  activities  on  nothing  more  than 
yoga  and  mysticism.  However,  within  just  a  few 
years,  the  organization  saw  its  membership  increase 
dramatically.  Aum  Shinrikyo,  whose  name  means 
“Supreme  Truth,”  tapped  into  the  Japanese 
“fascination  with  mystical,  obscure  religious  sects 
that  combine  the  spiritual  with  the  supernatural,” 
and  Asahara’ s  group  grew  rapidly.15  In  August  1989, 


Shoko  Asahara 

Shoko  Asahara,  the  founder  of  Aum 
Shinrikyo,  was  a  yoga  instructor  born  in 
1955  in  Yatsushiro,  located  on  the  southern 
Japanese  island  of  Kyushu.  Described  by 
some  as  a  “magnetic  misfit,”  he  was  the  sixth 
of  seven  children  and  was  raised  in  a  poor 
family.12  He  had  weak  vision  due  to  infantile 
glaucoma  and  attended  a  school  for  the  blind, 
where  he  emerged  as  a  leader,  because  he 
had  better  vision  than  his  classmates.11 
After  his  admission  to  Tokyo  University  was 
rejected,  Asahara  became  involved  in  yoga, 
meditation,  and  selling  Chinese  medicine  at  a 
pharmacy.  He  was  arrested  (but  not 
imprisoned)  in  1982  on  suspicion  of  violating 
Japanese  pharmaceutical  laws  by  selling 
unregulated  medicines,  and  his  pharmacy 
subsequently  went  out  of  business.14 
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Aum  was  granted  status  as  a  religious  sect  and,  because  the  Japanese  government  did  not  want  to 
be  perceived  as  stifling  religious  freedom,  the  group  was  granted  massive  tax  breaks  and 
immunity  from  any  type  of  oversight,  as  were  all  of  Japan’s  183,000  religious  organizations.16 
Eventually,  Aum  Shinrikyo  had  10,000  members  in  Japan,  more  than  25,000  adherents  in  Russia, 
and  approximately  15,000  followers  in  six  other  countries,  with  offices  in  Sri  Lanka,  Australia, 
Germany,  and  the  United  States.17 

In  February  1990,  Asahara  and  two  dozen  of  his  followers  ran  in  an  election  for  the  Japanese 
Diet,  or  Parliament,  under  the  banner  of  the  Shinrito  Party.  Confident  that  they  would  win  a 
resounding  victory,  Asahara  and  his  fellow  Aum  candidates  were  shocked  to  receive  not  even  the 
endorsement  of  all  of  Aum’s  members.  According  to  a  U.S.  Senate  report  written  after  the  March 
1 995  attack,  this  electoral  defeat  is  almost  “universally  held”  as  the  point  of  no  return  for  Aum 
Shinrikyo;  afterwards,  members  of  Aum  “gave  up  on  all  legal  pretensions  and  turned  away  from 
normal  interactions  with  the  larger  Japanese  society.”18 

From  this  point  forward,  Shoko  Asahara  placed  additional  emphasis  on  his  purported  belief  that 
Armageddon  was  coming  and  that  only  those  who  received  enlightenment  through  his  group 
would  survive  the  Earth’s  end.19  In  addition,  he  suggested  that  the  end  of  the  world  would  come 
in  the  form  of  a  war  between  Japan  and  the  United  States,  using  weapons  of  mass  destruction.  He 
decided  that  Aum  should  develop  chemical  and  biological  weapons,  either  to  prepare  for  this 
expected  war  or  to  launch  preemptive  strikes  against  Japanese  and  Western  enemies.20  With  vast 
resources  and  targeted  recruitment  of  bright  university  graduates,  Aum  Shinrikyo  was  well  poised 
to  go  down  the  path  that  would  eventually  result  in  the  sarin  gas  attacks  of  March  1995. 

Acquisition  of  Resources 

Aum  Shinrikyo  had  large  quantities  of  money  to  fund  its  activities — funds  that  were  not  subject 
to  official  oversight  from  the  Japanese  government  or  other  entities,  given  the  group’s  protected 
status  as  a  religious  sect.  Estimates  indicate  that  Asahara  and  his  group  had  cash  reserves  in 
excess  of  one  billion  dollars,  from  donations,  sales  of  religious  materials,  criminal  activities,  and 
businesses.21  These  cash  reserves  meant  that  Aum  was  able  to  pay  contractors  to  supplement  the 
group’s  knowledge  and  skills.  Members  of  elite  Russian  security  organizations  and  other  special 
operations  forces  provided  training  in  martial  arts,  escape  and  evasion  techniques,  and  the  use  of 
small  arms  to  Aum  Shinrikyo’s  members.22 

Aum  also  may  have  relied  upon  Russian  expertise  for  acquiring  knowledge  about  sarin 
production.  Several  sources  reveal  that  Aum  Shinrikyo  obtained  a  formula  for  synthesizing  sarin, 
likely  either  from  a  Russian  scientist  who  visited  Aum’s  facility  in  Japan  or  from  a  written 
formula,  although  the  timing  of  this  event  is  not  known.  Perhaps  most  indicative  of  a  transfer  of 
information  from  Russian  experts  to  those  in  Aum  Shinrikyo  is  the  fact  that  the  sarin  produced  by 
Aum  “was  synthesized  in  a  fashion  that  is  unique  to  the  Soviet  arsenal  of  chemical  agents.”23  In 
today’s  environment,  groups  may  not  need  to  rely  on  face-to-face  contact  with  outside  experts. 
Such  information  may  be  available  on  the  Internet  or  through  other  sources. 

Motivation 

Initially,  those  investigating  the  case  believed  that  Asahara  ordered  the  sarin  attack  on  the  subway 
system  as  a  means  of  bringing  about  the  apocalypse,  the  arrival  of  which  was  a  central  facet  of 
Aum’s  belief  system.  According  to  this  belief,  the  sarin  gas  attack  was  intended  to  topple  the 
Japanese  government  “in  an  elaborate  scheme  to  hasten  Armageddon.”24 
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However,  after  conducting  interviews  with  Aum  members  arrested  for  their  role  in  the  sarin  gas 
attack,  investigators  realized  that  the  group’s  actions  had  been  prompted  by  Asahara’s  fears  that 
police  were  about  to  conduct  a  raid  on  Aum’s  compound  near  Mount  Fuji.  One  day  before  the 
attack,  the  police  had  entered  the  sect’s  Osaka  headquarters  and  arrested  three  members  of  the 
group.  Apparently,  Asahara  and  the  organization’s  top  leadership  either  suspected  or  had  inside 
knowledge  that  the  Japanese  police  were  planning  to  search  Aum  Shinrikyo’s  main  facilities  near 
Mount  Fuji  and  decided  to  launch  the  subway  attack  to  divert  the  authorities’  attention.25 

Planning 

Aum  Shinrikyo ’s  Earlier  Operations 

While  little  is  known  about  the  specific  planning  for  this  attack,  Aum’s  earlier  attacks  and  its 
chemical  and  biological  weapons  research  are  well  chronicled,  and  some  of  these  activities  may 
have  provided  the  training  needed  to  prepare  for  the  attacks  of  March  20,  1995.  Aum  tried  to 
launch  its  first  biological  weapons  attack  in  April  1990,  when  group  members  attempted  to  spray 
an  aerosolized  form  of  botulinum  toxin  over  a  wide  area  of  downtown  Tokyo,  including  the 
building  housing  the  Japanese  Diet.  However,  this  attack  failed  because  Aum  members  had  not 
properly  extracted  the  botulinum  from  the  soil  that  contained  it  (Aum  members  had  gathered  the 
soil  from  a  river  basin  in  Hokkaido,  Japan  and  extracted  the  botulinum  from  it  in  their 
laboratory),  and  the  toxin  was  not  lethal.26 

Over  the  next  few  years,  Aum  Shinrikyo  attempted  to  carry  out  attacks  with  botulinum  toxin, 
anthrax,  and  sarin,  but  all  of  these  attempts  failed,  often  because  the  agents  were  unusable  or 
because  the  spraying  devices  used  to  disseminate  the  agents  were  clogged.27  In  June  1994,  group 
members  launched  a  sarin  attack  against  an  apartment  building  in  Matsumoto,  Japan,  in  an  effort 
to  kill  three  judges  who  were  presiding  over  a  civil  suit  brought  against  Aum  Shinrikyo.  Aum 
operatives  drove  a  van  into  the  residential  Kaichi  Heights  neighborhood,  vaporized  the  sarin  by 
heating  it,  and  then  blew  the  gas  out  of  the  van  with  a  fan.  The  poisonous  agent  seeped  into  the 
windows  of  the  apartment  building,  eventually  killing  seven  people  and  injuring  more  than  500, 
including  the  three  targeted  judges.28  Following  the  incident,  the  authorities  believed  that  a 
chemical  salesman  who  lived  nearby  had  accidentally  released  the  agent;  however,  investigation 
later  revealed  that  none  of  the  compounds  in  his  house  could  have  resulted  in  the  toxic  effect  this 
incident  had,  and  prior  to  the  March  1995  attacks,  traces  of  sarin  were  found  at  the  site  of  the 
Matsumoto  attack.  Evidence  that  surfaced  after  the  arrest  of  Aum  members  following  the  March 
1995  attack  clearly  implicated  the  group  in  the  attack  at  Matsumoto.29 

In  the  nine  months  between  the  Matsumoto  attack  and  the  subway  attack  of  March  1995,  Aum 
continued  to  test  its  skills  with  chemical  and  biological  weapons,  launching  operations  in  and 
around  Tokyo  and  meeting  with  more  success  than  it  had  with  any  earlier  attempts  (other  than  the 
Matsumoto  incident).  In  September  1994,  Aum  operatives  sprayed  phosgene  gas  through  the  mail 
slot  of  a  journalist  who  had  accused  the  group  of  kidnapping  a  man.  The  journalist  survived  but 
had  difficulty  talking  and  breathing  after  the  attack.10  Three  months  later,  the  group  launched  an 
attack  against  Tadahiro  Hamaguchi,  a  man  who  had  been  assisting  dissident  members  of  the 
group.  Members  of  Aum  sprayed  VX  nerve  gas  on  the  man  as  he  walked  on  a  street  near  his 
home,  and  he  died  10  days  after  the  attack.31  In  a  similar  incident,  Aum  attacked  Hiroyuki 
Nagaoka,  the  head  of  the  Association  of  the  Victims  of  Aum  Shinrikyo,  with  VX  gas,  and 
although  he  survived,  he  was  in  a  coma  for  several  weeks.12  Just  five  days  before  the  sarin  gas 
attack,  three  members  of  Aum  Shinrikyo  placed  briefcases,  equipped  to  spray  a  liquid  form  of 
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anthrax,  at  the  turnstiles  of  the  Kasumigaseki  station  (this  is  the  same  station  that  would  be 
targeted  on  March  20).  However,  one  of  the  Aum  members  replaced  the  toxin  with  water,  and  the 
attack  was  not  carried  out  as  planned.33 

Preparation  for  the  Attack 

Having  shown  a  clear  interest  in  launching  attacks  using  chemical  and  biological  weapons, 
Asahara  decided  to  conduct  an  operation  against  trains  converging  upon  the  Kasumigaseki  station 
using  sarin  gas.  Exploiting  the  operational  predictability  of  the  passenger  rail  sector,  Aum 
selected  five  trains  as  targets,  all  scheduled  to  arrive  at  Kasumigaseki  station  within  four  minutes 
of  each  other  at  the  height  of  morning  rush  hour,  shortly  after  8:00  AM.  Located  at  a  point  where 
several  major  Tokyo  subway  lines  meet,  Kasumigaseki  station  is  situated  in  the  heart  of  the  city’s 
government  district  and  is  within  walking  distance  of  the  Ministries  of  Health  &  Welfare,  Foreign 
Affairs,  Finance,  and  Taxation,  as  well  as  the  Tokyo  Police  Headquarters.  Many  of  those  who 
rode  the  subways  to  the  station  would  have  been  employees  of  these  agencies,  and  this  may  have 
played  a  role  in  Asahara’ s  target  selection.34 

With  regard  to  weapons  selection  and  preparation,  the  attack  at  Matsumoto  had  proven  to  Aum 
Shinrikyo  that  it  had  the  capability  to  carry  out  operations  using  sarin  gas.  According  to  testimony 
from  group  members,  sarin  was  appealing  to  Aum  Shinrikyo  because  its  precursors  were  readily 
available  and  it  was  fairly  easy  to  produce.35  One  day  before  the  attack  in  a  secret  laboratory  at 
Aum’s  compound  near  Mount  Fuji,  senior  members  of  the  group,  under  the  direction  of  Tsuchiya, 
manufactured  the  sarin,  pouring  it  into  the  polyester  bags  that  would  be  taken  onto  the  subway 
cars  during  rush  hour  the  next  morning.36  Aum  members  were  aware  of  the  limited  screening 
capability  associated  with  the  rail  sector  and  likely  felt  confident  that  they  would  be  able  to  bring 
their  weapons  onboard  the  subway  cars  without  being  detected. 

The  preparation  for  this  attack  may  reflect  examples  of  terrorist  learning.  Aum  Shinrikyo  relied 
upon  information  gathered  from  those  outside  the  group  as  well  as  from  the  group’s  earlier 
activities  and  an  extensive  collection  of  books  and  manuals.  37  Aum  scientists  appear  to  have 
obtained  information  from  Russian  experts  that  provided  the  capability  necessary  to  manufacture 
sarin  gas.  Group  members  also  seem  to  have  learned  from  their  own  previous  operations.  Instead 
of  using  botulinum  toxin,  which  had  not  worked  well  for  the  group  in  the  past,  Aum  operatives 
selected  sarin  as  their  weapon  of  choice,  perhaps  because  its  use  in  the  Matsumoto  attack  had 
resulted  in  the  death  of  seven  people. 

Attack 

Shortly  before  8:00  AM,  in  the  midst  of  morning  rush  hour  on  Monday,  March  20,  1995,  five 
Aum  Shinrikyo  operatives  placed  bags  containing  sarin  on  three  lines  of  the  Tokyo  subway 
system.  Two  young  physics  graduate  students  brought  the  sarin  aboard  trains  running  on  opposite 
ends  of  the  Hibiya  Line,  a  physicist  and  an  engineer  placed  their  bags  of  poison  on  trains  at  either 
end  of  the  Maruouchi  Line,  and  a  former  cardiovascular  surgeon  targeted  a  car  on  the  Chiyoda 
Line.  Each  train  was  scheduled  to  arrive  at  the  Kasumigaseki  Station  within  minutes  of  one 
another.  As  the  trains  approached  the  designated  station,  the  five  men  punctured  8  of  the  1 1  bags 
of  sarin  with  sharpened  umbrella  tips  to  release  the  gas,  then  promptly  exited  their  trains,  which 
moved  on  along  the  tracks.  They  were  immediately  picked  up  by  five  other  members  of  Aum 
Shinrikyo,  who  had  been  pre-positioned  with  get-away  cars,  and  went  to  a  hideout  where  they 
received  injections  of  sarin  antidote.38 
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Within  minutes  of  the  release  of  the  sarin  gas,  passengers  and  train  staff  were  suffering  the  ill 
effects  of  the  poison.  As  the  trains  stopped,  passengers  fell  out,  bleeding,  coughing,  vomiting,  and 
experiencing  spasms — according  to  witnesses,  the  station  entrances  seemed  like  “battlefields,  as 
injured  commuters  lay  gasping  on  the  ground  with  blood  gushing  from  their  noses  or  mouths.” 39 
Some  were  unable  to  escape  the  trains  and  lay  on  the  floors  of  the  cars  in  pain.  Those  who  were 
able  ran  up  to  street  level  to  escape  the  noxious  fumes  and  to  breathe  in  the  fresh  air.40 

Consequences 

The  impact  of  this  attack  was  significant  in  a  number  of  ways.  Twelve  people  died  from  the 
effects  of  the  sarin  gas — 10  shortly  after  the  attack  and  two  later.41  More  than  5,500  people  went 
to  the  hospital,  some  by  ambulance  and  the  rest  on  foot,  by  taxi,  or  in  private  vehicles.42  Of  those, 
17  were  considered  critically  ill  (12  of  these  died),  37  severely  ill,  and  98  moderately  ill;  the 
remaining  victims  were  categorized  as  being  in  psychological  rather  than  physical  distress.43 

That  said,  many  more  people  might  have  died  if  the  weapons  had  functioned  as  Aum  intended. 
Three  of  the  bags  brought  onto  the  trains  by  the  operatives  were  not  punctured,  meaning  that  not 
all  of  the  sarin  gas  was  released.  In  addition,  according  to  chemical  weapons  experts,  the  sarin 
was  impure  and  the  system  used  to  disseminate  it  was  inferior.44  The  number  of  those  killed  and 
injured  may  have  been  further  reduced  by  the  fact  that  the  following  day  was  a  national  holiday 
celebrating  the  first  day  of  spring — at  least  one  of  the  trains  was  less  crowded  than  it  would  have 
been  during  a  typical  Monday  morning  rush  hour.45  Eventually,  20  members  of  Aum  were 
arrested  for  their  role  in  the  attack,  and  a  number  of  them,  including  Shoko  Asahara,  are  on  death 
row  in  Japan.46 

Disruption  to  the  Tokyo  subway  system  was  minor — 15  stations  and  three  separate  train  lines 
were  impacted — but  there  was  extensive  media  coverage  of  the  event. 47  Both  of  these  likely 
would  have  been  viewed  as  successful  outcomes  by  Aum  Shinrikyo.  However,  there  was  also  a 
negative  impact  on  the  group  at  the  operational  level.  Following  the  attack,  Aum  lost  its  status  as 
a  Japanese  religious  cult,  renamed  itself  Aleph  (knowing  that  any  identification  with  those  who 
had  carried  out  the  attack  would  be  detrimental),  and  became  subject  to  government 
surveillance.48  As  such,  the  operation  certainly  did  not  have  the  effect  that  Asahara  had 
intended — averting  a  police  raid  on  the  organization. 

Aum  achieved  both  positive  and  negative  results  from  this  attack.  The  long-term  psychological 
impact  on  the  target  population  can  be  characterized  as  high.  The  influence  of  this  incident  went 
beyond  those  riding  the  trains  that  day.  There  is  little  doubt  that  commuters  in  other  parts  of  Japan 
and  around  the  world  were  shocked  by  this  attack,  given  that  it  marked  the  first  time  a  weapon  of 
mass  destruction  had  been  used  in  this  environment.  Further,  the  psychological  effects  of  this 
event  were  long-term:  more  than  six  years  after  the  attack,  a  survey  by  the  Japanese  National 
Police  Agency  revealed  that  20%  of  the  victims  still  suffered  post-traumatic  stress  disorder.49  The 
survey  also  indicated  that  43%  of  the  victims  continued  to  have  flashbacks  to  the  attack.  50 

Nonetheless,  while  the  terrorists  may  have  intended  for  the  attack  to  cause  great  economic 
disruption,  there  was  little  actual  economic  impact  from  this  attack — the  greatest  loss  likely  came 
from  missed  time  at  work  by  those  who  were  suffering  the  effects  of  the  sarin  gas.  There  were  no 
changes  in  Japanese  foreign  policy  and  only  minor  changes  to  security  procedures  following  the 
attack,  although,  as  noted  earlier,  Aum  Shinrikyo  did  lose  its  status  as  a  religious  organization. 
Further,  in  1996,  Japan’s  Religious  Corporation  Faw  was  amended  to  mandate  greater  disclosure 
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of  financial  assets  by  religious  organizations  and  to  provide  the  government  with  greater 
oversight  authority  for  such  groups.51 

Four  months  after  the  attack,  the  Japanese  transport  minister  requested  that  security  cameras  be 
installed  throughout  the  Tokyo  subway  system  as  a  deterrent  to  terrorism.52  The  law  enforcement 
learning  from  Aum’s  activities  was  widespread:  following  the  March  1995  operation,  the 
Washington  Metropolitan  Area  Transit  Authority  took  the  lead  in  developing  a  chemical  sensing 
system  for  subway  systems  in  the  United  States.55  The  changes  in  policy  toward  Aum  Shinrikyo 
and  the  consideration  of  new  security  measures  are  reflections  of  the  law  enforcement  and 
government  learning  that  occurred  as  a  result  of  the  sarin  gas  incident. 

Factors  Associated  With  Success  or  Failure 

The  mixed  “success”  of  this  attack  may  be  attributed  to  a  number  of  factors: 

Training :  Aum’s  many  attempted  and  actual  attacks  prior  to  the  incident  on  the  subway  can  be 
considered  training  for  this  operation.  In  addition,  Asahara’s  strategy  of  recruiting  individuals 
with  scientific  backgrounds  may  have  meant  that  less  training  was  required  for  specific  attacks  as 
these  members  had  the  desired  skill  sets.  At  the  same  time,  Aum  Shinrikyo  had  never  carried  out 
a  chemical  weapons  attack  on  a  subway  until  the  day  of  the  attack. 

Technical  sophistication :  Prior  to  this  incident,  members  of  Aum  Shinrikyo  had  experienced 
difficulty  with  the  technical  aspects  of  chemical  and  biological  weaponry,  and  the  same  was  true 
on  March  20,  1995.  The  sarin  used  in  the  attack  was  impure;  Japanese  experts  speculated  that  the 
sarin  had  been  diluted  so  that  it  would  not  kill  the  terrorists,  and  American  experts  suggested  that 
it  had  not  been  purified  properly  when  it  was  manufactured  or  that  it  had  been  stored  for  too 
long.54  Some  evidence  indicates  that  the  attack  occurred  sooner  than  Asahara  had  originally 
planned,  given  his  fears  of  a  police  raid  on  Aum’s  compound.  After  their  arrests,  Aum  scientists 
testified  that  their  preparations  had  been  rushed,  and  although  they  had  asked  for  more  time  to 
prepare  the  sarin  properly  before  the  attack,  these  requests  were  denied/5  Impure  sarin  has  a 
distinct  odor  that  the  undiluted  form  of  the  gas  does  not;  this  smell  made  those  riding  the  subways 
realize  that  something  was  wrong  and  may  have  prompted  some  of  them  to  escape  sooner  than 
they  would  have  otherwise.56  Regardless  of  the  reasons  why  the  sarin  was  not  pure,  there  were 
additional  technical  sophistication  issues  with  the  dispersal  mechanisms  used  by  Aum  on  the  day 
of  the  attack.  The  bags  into  which  the  sarin  was  placed  were  described  as  “primitive,”  and  this 
form  of  dispersal  did  not  allow  the  sarin  to  distribute  effectively  into  the  air.57 

Operational  Proficiency.  The  terrorists  who  executed  the  attack  were  moderately  proficient. 
While  they  successfully  pierced  eight  of  the  bags  containing  sarin,  they  failed  to  do  so  on  the 
remaining  three. 

Terrorist  profile  indicators'.  The  members  of  Aum  Shinrikyo  came  from  a  variety  of  backgrounds 
and,  as  mentioned,  included  scientists,  graduate  students,  doctors,  and  businessmen,  as  well  as 
military  and  law  enforcement  personnel.  There  is  little  evidence  to  suggest  that  any  of  Aum’s 
members  should  have  stood  out  to  the  authorities. 

Terrorist  OPSEC :  It  appears  that  Aum  Shinrikyo  practiced  good  operational  security  while 
preparing  this  attack,  assembling  the  weapons  in  a  secret  laboratory  on  the  premises  of  the  Mount 
Fuji  area  compound.  After  the  attack,  Japanese  police  and  local  and  foreign  observers  reported 
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that  the  attack  had  taken  them  by  complete  surprise,  indicating  that  Aum  had  given  little 
indication  that  the  operation  was  forthcoming. 

Innovation-.  This  attack  may  be  considered  highly  innovative,  as  its  occurrence  marked  the  first 
time  that  terrorists  had  targeted  the  passenger  rail  sector  with  chemical  weapons.  Further, 
members  of  Aum,  relying  upon  information  from  the  Russians,  manufactured  a  known  chemical 
weapons  agent. 

Observant  public  and/or  vigilant  security  services:  In  July  1994,  one  month  after  the  attack  in 
Matsumoto,  a  family  that  lived  near  Aum’s  compound  reported  that  leaves  on  the  nearby  trees 
were  turning  brown,  as  if  something  in  the  air  was  causing  them  to  die.  Furthermore,  everyone  in 
the  family  noticed  a  horrible  smell  in  the  air  and  began  suffering  from  burning  eyes  and  nausea. 
When  a  family  member  reported  the  situation  to  environmental  agencies  and  local  police,  cult 
members  received  a  warning  from  the  authorities,  but  no  further  action  was  taken  toward  Aum 
members.58  Those  in  the  surrounding  village  were  angered  and  horrified,  especially  after  an 
article  in  a  local  newspaper  revealed  that  police  had  discovered  potential  residues  of  sarin  in  the 
soil  surrounding  Aum’s  compound,  following  reports  from  the  family  that  lived  nearby.59 

Perhaps  the  local  police  were  hindered  by  the  same  concerns  as  the  Japanese  government  and  did 
not  want  to  investigate  the  cult  due  to  concern  of  treading  on  religious  freedom.60  Or  perhaps,  as 
some  have  said,  the  Japanese  police  were  just  “clumsy”  and  bungled  any  operations  aimed  at 
curtailing  Aum’s  activities  prior  to  the  attack  in  March  1995. 61  In  any  event,  while  the  Japanese 
public  may  be  characterized  as  relatively  observant,  it  appears  that  the  security  forces  were  not 
vigilant  with  regard  to  Aum  Shinrikyo’s  attack  preparations. 

Law  enforcement  or  intelligence  knowledge:  Given  Aum’s  activities  prior  to  the  March  1995 
operation,  there  is  little  doubt  that  both  law  enforcement  and  intelligence  entities  knew  about  the 
group  and  its  penchant  for  biological  and  chemical  warfare,  although  the  actual  attack  seems  to 
have  come  as  a  surprise.  Following  the  events  of  March  20,  the  law  enforcement  personnel  were 
“derided  .  .  .for  failing  to  halt  Aum’s  murderous  rampage.”62  Whether  the  minimal  investigation 
of  Aum’s  activities  prior  to  the  sarin  attacks  was  due  to  ignorance  or  unwillingness  to  investigate 
potential  leads  on  the  part  of  law  enforcement,  it  seems  that  the  group  did  not  receive  the 
attention  it  deserved.  According  to  some  reports,  Aum  Shinrikyo  had  informants  within  the 
National  Police  Agency,  and  this  may  have  had  a  bearing  on  the  level  of  scrutiny  given  to  the 
group.63  In  addition,  there  is  some  evidence  to  suggest  that  Aum  may  have  paid  bribes  to  certain 
members  of  Japan’s  Liberal  Democratic  Party,  and  this  too  could  have  influenced  the  level  of 
investigation  to  which  Asahara  and  his  group  were  subject.64 

Security  environment:  At  the  time  of  the  attack,  the  environment  in  Japan  could  be  characterized 
as  permissive  toward  Aum  Shinrikyo,  because  the  group  was  considered  a  religious  organization 
under  Japanese  law.  Aum  exploited  this  status  and  was  subject  to  far  less  scrutiny  than  it  might 
have  been  otherwise.  Religious  organizations  in  Japan  were  given  large  tax  breaks  and  were 
immune  from  official  oversight,  and  Asahara  used  this  to  his  advantage.  While,  in  practice, 
religious  organizations  such  as  Aum  Shinrikyo  could  be  investigated  for  criminal  activity,  in 
actuality,  the  chances  of  this  occurring  were  negligible,  because  the  Japanese  government  was 
reluctant  to  investigate  any  type  of  religious  group,  for  fear  of  being  seen  as  intruding  upon 
citizens’  freedom  of  religion.65 
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Effective  information  sharing :  There  was  little  effective  information  sharing  prior  to  the  sarin  gas 
attacks.  Domestically,  there  was  little  to  no  exchange  of  information  among  Japanese  entities 
about  Aum  Shinrikyo  and  its  activities.66 

International  cooperation :  Internationally,  while  Japan  and  the  United  States  discussed  the  group, 
the  CIA,  others  within  the  American  government,  and  officials  in  Japan  and  Russia  did  not  take 
the  group  seriously  until  after  the  March  1995  operation. 

Findings 

While  several  factors  mentioned  above  aided  Aum  Shinrikyo  in  its  attack  on  March  20,  1995,  the 
low  number  of  casualties  meant  that  the  operation  was  less  successful  than  the  group  intended. 

The  group  was  highly  innovative  in  its  use  of  chemical  weapons  and  exploited  the  vulnerabilities 
of  the  rail  sector.  Using  the  open  architecture  and  limited  screening  practices  of  the  Tokyo 
subway  system  to  their  advantage,  Aum  Shinrikyo  members  knew  that  the  sarin  gas  would  not  be 
discovered  until  they  released  it  during  morning  rush  hour. 

Japan’s  favorable  laws  toward  religious  organizations,  such  as  Aum  Shinrikyo,  certainly 
enhanced  the  group’s  ability  to  gather  resources  and  plan  operations  without  intervention  from 
government  officials  or  law  enforcement  personnel.  Free  from  oversight,  Asahara  and  his 
followers  were  able  to  build  up  considerable  financial  resources,  conduct  research,  and  develop 
chemical  and  biological  agents  in  their  laboratory.  Although  authorities  were  aware  of  some  of 
Aum’s  prior  attacks,  this  particular  operation  caught  them  by  surprise. 

Once  the  attack  was  carried  out,  it  had  a  worldwide  impact,  as  news  of  the  incident  was 
disseminated  by  international  media  outlets.  The  operation  led  to  stepped  up  countermeasures  as 
far  away  as  Washington,  DC,  where  the  local  transit  authority  led  efforts  to  develop  a  chemical 
weapons  detection  system. 

At  the  same  time,  conducting  a  chemical  weapons  attack  is  not  an  easy  operation,  and  it  seems 
that  the  attack  was  not  as  lethal  as  Aum  Shinrikyo  likely  had  intended.  According  to  testimony 
from  those  arrested  after  the  attack,  preparations  were  rushed,  due  to  an  impending  police  raid.  If 
group  members  had  not  been  denied  their  request  for  more  time  to  prepare  the  sarin,  it  might  have 
been  purer  and  resulted  in  far  more  than  12  deaths.  Thus,  internal  group  dynamics  played  a  role  in 
an  outcome  that  was  less  successful  than  intended.  While  this  attack  resulted  in  some  success  for 
the  group,  the  negative  impacts  eliminated  any  possibility  that  Aum  could  survive  or  be  a  political 
factor  in  Japan  or  elsewhere. 
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New  York  City  Subway  Bomb  Plot — July 

1997 

Overview 

In  July  1997,  two  Palestinian  natives  of  the  West  Bank  planned  to  attack  Brooklyn’s  Atlantic 
Avenue  subway  station  using  improvised  explosive  devices  (IEDs).  The  plot  was  discovered 
when  a  roommate,  to  whom  they  had  shown  one  of  the  assembled  devices,  notified  police. 
Believing  the  attack  was  imminent — possibly  planned  to  occur  as  soon  as  the  next  day — the  New 

York  City  police  department  raided  the  suspects’  apartment, 
arrested  the  suspects,  and  seized  two  IEDs. 

Significance  of  the  Incident 

As  demonstrated  by  the  successful  attacks  on  subway  and 
commuter  rail  systems  in  Tokyo,  London,  Madrid,  and 
Mumbai,  some  terrorist  groups  have  identified  the  rail  sector  as  a  relatively  high  payoff  target  for 
a  simple,  inexpensive  attack. 

The  1997  plot  is  significant  because  it  targeted  a  major  U.S.  metropolitan  subway  system  and 
came  very  close  to  the  execution  phase.  As  such,  it  is  an  informative  case  for  examining  the  threat 
to  the  U.S.  homeland  posed  by  such  attacks  and  serves  as  a  vehicle  for  applying  information  to 
the  U.S.  context  gleaned  from  overseas  attacks. 

Description  of  the  Group  or  Individuals  Involved 

Two  men  were  involved  in  this  plot:  Gazi  Ibrahim  Abu  Mezer  and  Lafi  Khalil.  There  is  no  known 
connection  between  these  individuals  and  any  terrorist  organization;  however,  Mezer  claimed  in 
an  application  for  asylum  that  he  had  been  arrested  by  Israeli  authorities  for  being  associated  with 
Hamas.67  He  claimed  that  the  accusation  was  baseless. 

Gazi  Ibrahim  Abu  Mezer  was  bom  in  1973, 68  into  a  well-educated,  middle-class  family  and  raised 
in  a  modest  home  in  the  West  Bank  town  of  Hebron.69  Lying  approximately  20  miles  south  of 
Jerusalem,  Hebron  has  been  a  focal  point  of  Israeli-Palestinian  conflict  in  the  West  Bank  since  its 
occupation  in  the  1967  War.70  Mezer  supported  the  Palestinian  Front  for  the  Liberation  of 
Palestine  as  a  teenager71  and,  like  many  of  his  age  at  that  time,  participated  in  the  First  Intifada. 

He  was  detained  twice  by  Israeli  authorities  during  this  period,  but  never  arrested.72  His  political 
activity  seemed  to  be  limited  to  general  support  of  the  Liberation  Front  and  stone  throwing  during 
the  Intifada,  but  there  were  events  that  could  have  contributed  to  later  radicalization:  for  example, 
the  Israeli  authorities  destroyed  his  uncle’s  auto  parts  store  and  his  brother  was  briefly  deported 
for  political  activities.73  His  attitude  also  may  have  been  hardened  by  a  massacre  of  Palestinians 
which  took  place  in  Hebron  five  months  after  his  departure  from  the  city:  in  February  1994, 
Baruch  Goldstein  killed  29  Arab  worshippers  at  the  Cave  of  the  Patriarchs.  Ironically,  Goldstein 
was  an  immigrant  to  Israel,  originally  from  New  York  City.74 

In  May  1993,  Mezer  applied  for  a  student  visa  from  Canada;  in  July  of  that  year,  he  received  the 
required  travel  document  from  Israel  permitting  him  to  go  to  any  country  that  granted  him  a  visa 
and  allowing  his  readmission  to  Israel  provided  he  returned  by  July  5,  1994.  On  September  10, 


Type  of  Attack:  Planned  attack  on 
New  York  City  subway  system 
using  improvised  explosive  devices 
Date:  July  1997 
Individuals  Involved:  Gazi 
Ibrahim  Abu  Mezer  and  Lafi  Khalil 
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1993,  Mezer  was  granted  a  Canadian  student  visa,  which  would  allow  him  to  remain  in  Canada  as 
long  as  he  was  enrolled  in  an  educational  program.75  Shortly  after  his  arrival  in  Canada,  he 
applied  for  asylum;76  under  Canadian  law,  an  asylum  seeker  is  permitted  to  remain  in  the  country 
while  the  application  is  being  adjudicated.77  During  this  period,  Mezer  was  twice  arrested:  once 
for  assault  and  once  for  using  a  stolen  credit  card.  In  both  cases,  he  was  sentenced  to  one  year  of 
unsupervised  probation  but  was  not  forced  to  leave  Canada.78 

Mezer’ s  ultimate  goal  was  to  enter  the  United  States.  Initially,  he  tried  to  enter  legally  by 
applying  for  a  non-immigrant  visa  nine  days  after  arriving  in  Canada.  He  received  a  “routine 
refusal;”  the  precise  reasons  were  not  recorded,  but  typically  a  routine  refusal  is  issued  if  the 
applicant  cannot  show  evidence  that  he  will  not  overstay  the  visa.  Such  a  decision  often  is  based 
on  factors  such  as  age,  lack  of  financial  resources,  or  lack  of  family  ties  that  would  motivate  an 
applicant  to  return  to  his  country  of  origin.79 

Mezer  then  made  three  unsuccessful  attempts  to  enter  the  United  States  illegally.  The  first  two 
attempts  were  made  less  than  a  week  apart  in  June  1996,  in  Ross  Lake  and  Blaine,  Washington. 

In  both  cases,  he  was  caught  by  U.S.  Border  Patrol  agents  and  returned  to  Canada.  In  the  third 
attempt,  in  January  1997,  Mezer  crossed  the  border  successfully  but  was  arrested  by  an  alert 
Border  Patrol  agent  at  a  bus  station  in  Bellingham,  Washington,  who  believed  Mezer  and  two 
others  were  behaving  suspiciously.80  After  this  third  attempt,  the  Canadian  authorities  refused  to 
allow  him  back  in  their  country,  citing  his  previous  arrests  and  attempts  to  cross  the  border 
illegally.81  Now  facing  deportation  back  to  the  West  Bank,  Mezer  petitioned  for  asylum  in  the 
United  States.  He  posted  bond  and  was  released  from  detention;  his  case  was  still  being 
adjudicated  at  the  time  of  his  arrest  in  the  subway  bomb  plot.82 

Lafi  Khalil  was  bom  and  raised  a  short  distance  away  from  Mezer’s  home,  but  under  much 
different  circumstances.  He  was  from  Ajoul,  an  affluent  suburb  of  Ramallah.  This  area  was  home 
to  some  of  the  wealthiest  and  most  influential  Palestinian  families,  and  due  to  its  affluence,  the 
Ramallah  suburbs  did  not  provide  a  great  deal  of  support  to  the  Intifada.83  Khalil  had  no  record  of 
arrest,  detention,  or  other  interest  on  the  part  of  Israeli  authorities. 

Khalil,  a  Palestinian  like  Mezer,  held  a  Jordanian  passport.  His  plan  to  enter  the  United  States 
involved  two  steps.  First,  he  paid  an  acquaintance  to  fraudulently  obtain  a  valid  visa  stamp  for 
Ecuador.84  Once  he  had  this,  he  sought  a  U.S.  C-l  (Transit)  visa,  which  allows  the  bearer  to 
remain  in  the  U.S.  for  up  to  29  days  on  his  way  to  a  destination  country.85  According  to  an 
investigation  by  the  Department  of  Justice’s  Inspector  General,  during  the  interview  at  the  U.S. 
consulate, 

Khalil  stated  that  he  was  a  Jordanian  national,  bom  in  1974  in  Ajoul,  Ramallah, 

West  Bank,  that  he  lived  in  that  region  with  his  family,  and  that  he  owned  part  of 
a  farm.  Khalil  was  not  asked  for  and  did  not  provide  any  documentary  proof  for 
these  assertions.  His  application  did  not  contain  responses  to  questions  regarding 
his  address  in  Israel,  his  home  or  business  telephone  numbers,  the  names  of  any 
individuals  with  whom  he  would  be  traveling  or  would  be  visiting  in  Ecuador,  or 
how  he  would  support  himself  when  in  the  United  States  or  in  Ecuador.86 

The  consular  officer  did  not  ask  to  see  an  airline  ticket  to  Ecuador  or  other  proof  of  such 
arrangements;  the  officer  stated  that,  in  fact,  the  consulate  discouraged  travelers  from  purchasing 
their  tickets  prior  to  obtaining  a  visa.  Consulate  officers  were  concerned  that  the  traveler  would 
waste  the  cost  of  the  ticket  should  the  visa  be  denied  or  not  approved  in  time  for  use.87 
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Khalil  arrived  in  the  United  States  on  the  evening  of  December  7,  1996.  Although  granted  the  29- 
day  C-l  Transit  visa  by  the  U.S.  Consulate  in  Jerusalem,  the  Immigration  Inspector  at  John  F. 
Kennedy  International  Airport  mistakenly  stamped  his  passport  with  a  B-2  (tourist)  visa  stamp; 
this  gave  Khalil  permission  to  remain  in  the  United  States  for  six  months,  expiring  on  June  6, 
1997. 88 

Mezer  and  Khalil  met  in  New  York,  where  they  shared  an  apartment  with  other  Arab  immigrants 
in  Brooklyn.89  They  traveled  together  to  North  Carolina  in  July  1997,  where  they  shared  a  trailer 
and  worked  briefly  at  an  IGA  supermarket.90  After  a  short  period,  they  returned  to  the  apartment 
in  New  York,  where  they  remained  until  their  arrest. 

Acquaintances  of  the  two  characterize  them  as  being  interested  only  in  women  and  making 
money,  and  not  particularly  religious.91  However,  evidence  found  in  the  apartment  after  their 
arrest  indicated  a  radical  orientation.  Investigators  found  a  note  expounding  radical  politics  which 
they  believe  may  have  been  a  suicide  note;  there  was  also  anti-Israel  political  literature  and  a 
portrait  of  “Blind  Sheikh”  Omar  Abdul  Rahman,  then  serving  a  life  sentence  for  his  role  in  the 
plot  to  attack  the  World  Trade  Center  in  1993. 92  Mezer  and  Khalil  are  also  known  to  have 
attended  the  radical  al  Farooq  mosque  while  living  in  New  York.93 

Motivation 

The  evidence  gathered  in  the  apartment  and  from  post-arrest  interviews  indicates  that  Mezer  and 
Khalil  were  motivated  by  a  hatred  of  Jews  engendered  by  events  in  the  Palestinian  territories  and 
a  desire  to  punish  the  United  States  for  its  support  of  Israel.  Mezer  told  investigators  he  had 
picked  the  Atlantic  Avenue  station  as  a  target  because  it  served  the  B  Train,  which  runs  through 
the  predominantly  Orthodox  Jewish  neighborhood  of  Brooklyn  Park,  and  he  desired  to  kill  as 
many  Jews  as  possible.94  During  his  trial,  Mezer  testified  “[I  have]  come  to  the  United  States 
because  I  feel  that  the  United  States  is  supporting  the  Jewish  state  and  the  United  States  should  be 
punished  for  supporting  Israel."95 

The  manifesto  found  in  their  apartment  specifically  demanded  the  release  of  several  accused 
terrorists  imprisoned  at  that  time.  Besides  Sheikh  Omar  Abdul  Rahman,  these  were  Sheikh 
Ahmed  Y assin,  the  spiritual  leader  of  Hamas  (who  was  imprisoned  in  Israel  at  that  time)  and 
Ramzi  Yousef,  tied  not  only  to  the  1993  plot  against  the  World  Trade  Center  but  also  the  Bojinka 
plot  in  1994- 1995. 96 

At  his  trial,  Mezer  declared  that  he  “had  always  wanted  to  be  a  martyr”  and  that  the  United  States 
was  waging  war  on  Islam;  he  wanted  to  be  “part  of  that  war.”97  The  two  also  took  great  interest  in 
the  suicide  bombing  by  Hamas  in  Jerusalem  on  July  29,  1997.  The  attack  claimed  the  lives  of  13, 
plus  the  two  suicide  bombers.  “They  were  heroes,”  stated  Mezer,  “and  we  wished  to  join  them.”98 
This  was  corroborated  by  the  statement  given  by  the  man  who  reported  their  plan  to  the  police: 
“My  roommates  are  going  to  follow  up  on  Jerusalem.”99 

These  statements  indicate  a  radical  mindset  that  turned  to  violence  to  avenge  perceived  abuse  and 
persecution;  however,  the  actual  event  or  events  that  triggered  this  transformation  have  not  been 
identified. 
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Planning 

Little  is  known  about  the  actual  planning  of  the  attack — specifically  when  the  planning  began  or 
whether  this  was  directed  by  a  larger  terrorist  group.  Nevertheless,  one  can  assume  that  two 
aspects  of  the  attack  required  careful  attention:  target  selection  and  the  design  of  the  weapon. 

Target  selection  would  have  centered  on  the  goal  “to  kill  as  many  Jews  as  possible”108  and  would 
have  been  fairly  straightforward,  since  the  ethnic  composition  of  neighborhoods  in  New  York  is 

easily  identified.  The  subway  would  have 
been  an  obvious  target,  since  it  offered  the 
terrorists  not  only  a  means  to  reach  the 
Jewish  neighborhood,  but  also  a  high 
concentration  of  potential  victims.  In  fact, 
Mezer  told  a  federal  agent  that  he 
specifically  targeted  the  B  Train  “because 
there  are  a  lot  of  Jews  that  ride  that 
train.”109  According  to  one  source,  the  B 
Train  “was  a  popular  line  for  the  Orthodox 
Jews  in  Brooklyn  Park  commuting  to  their 
jobs  in  the  Diamond  District  on  Forty- 
Seventh  Street  in  Midtown.”110 

The  two  may  have  conducted  pre- 
operational  surveillance  of  their  target;  in 
fact,  shortly  before  their  arrest,  they  were 
cited  for  “turnstile  jumping”  at  a  station 
joined  by  a  tunnel  to  the  Atlantic  Avenue 
station. 1 1 1 

Perhaps  the  most  difficult  aspect  of 
planning  the  attack  was  to  design  and 
construct  the  weapons.  The  design  and 
method  of  employment  are  similar  to 
weapons  used  in  the  West  Bank,  and  Mezer  and  Khalil  may  have  received  assistance  from 
acquaintances  back  home. 

Mezer  constructed  two  IEDs  consisting  of  five  pipe  bombs,112  four  of  which  were  joined  for  a 
combined  device  and  one  which  was  separate.113  The  larger  device,  according  to  an  FBI  bomb 
expert,  consisted  of  four  pipes,  filled  with  high-velocity  gunpowder,  which  Mezer  and  Khalil 
purchased  at  a  gun  shop  during  their  stay  in  North  Carolina,114  with  85  construction  nails  attached 
to  increase  lethality.  They  were  connected  by  wires  to  batteries  and  four  switches;  all  four  would 
need  to  be  activated  to  detonate  the  device.115  The  weapons  were  to  be  brought  on  board  the 
subway  in  backpacks;  this  would  exploit  the  vulnerability  of  limited  screening  on  passenger  rail 
systems.  The  method  of  employment  was  to  imitate  a  favorite  tactic  of  Hamas,  the  “double  tap;”  a 
device  is  set  off,  and  when  police  and  other  first  responders  arrive,  a  second,  larger  device  is  set 
off  to  inflict  more  casualties  and  spread  panic.116  Whether  the  terrorists  were  directly  supported 
by  Hamas  or  merely  inspired  by  its  actions,  they  were  technically  proficient;  an  FBI  expert 
reconstructed  a  similar  weapon  for  testing,  and  it  functioned  properly.117 


Hamas 

Authorities  have  never  come  to  a  definitive  conclusion 
as  to  whether  Hamas  was  behind  the  planned  attack.  At 
trial,  Mezer  claimed  to  be  “with  Hamas.”100  On  his 
U.S.  application  for  asylum,  he  said  that  he  had  been 
held  by  Israeli  authorities  for  connection  with  Hamas, 
but  at  that  time,  he  alleged  that  this  was  a  false 
accusation.101  In  addition,  Khalil  possessed  an  address 

book  containing  the  address  of  a  “known  member  of  a 

1 02 

terrorist  organization”  (not  further  identified). 

One  media  report  cited  unspecified  sources  as  stating 
that  the  two  suspects  may  have  phoned  members  of 
Hamas  from  pay  phones  near  their  apartment.10' 
However,  after  authorities  sifted  through  the  phone 
records  and  other  evidence,  they  were  unable  to  find 
any  link  between  the  two  and  Hamas.104  Furthermore, 
an  attack  against  a  U.S.  subway  would  have  been  a 
significant  strategic  departure  for  Hamas,  which  raises 
considerable  funds  in  the  United  States  and  had  never 
attacked  a  target  there.105 

According  to  Bruce  Hoffman,  then  with  the  University 
of  Saint  Andrew,  “It  would  very  much  be  out  of 
character  [for  Hamas]  to  operate  abroad.”106  Hoffman 
cautioned,  however,  that  it  would  be  a  mistake  to 

dismiss  any  Hamas  connection  to  the  plot  on  that  basis 
,  107 

alone. 
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The  design  of  the  weapons  and  concept  of  employment  could  reflect  terrorist  learning.  This  is 
certainly  true  if  the  attack  was  directed  by  Hamas — in  that  case,  methods  shown  to  be  effective  in 
the  West  Bank  were  adapted  to  and  employed  in  the  environment  in  the  United  States.  But  if  the 
terrorists  were  autonomous,  and  the  methods  and  designs  they  used  were  common  knowledge  at 
home,  this  would  demonstrate  indirect  terrorist  learning.  It  is  possible  for  tactics  to  be  spread 
through  diffusion  of  knowledge  in  a  community.  Such  informal  dissemination  of  information 
could  present  an  even  greater  challenge  to  security  services,  since  it  cannot  be  stopped  by 
apprehending  a  few  key  trainers. 

Attack 

Mezer  and  Khalil  appear  to  have  accomplished  all  tasks  required  to  conduct  a  successful  terrorist 
attack;  they  formed  a  small  team  with  required  proficiency;  they  selected  an  accessible  target  with 
sufficient  payoff;  they  chose  a  viable  method  of  attack  suitable  for  the  target;  they  gathered 
sufficient  information  on  the  target  to  select  the  Atlantic  Avenue  station  and  performed  pre-attack 
reconnaissance;  they  acquired  the  necessary  materials  to  carry  out  the  attack;  and  they 
constructed  a  viable  weapon.118  The  one  step  likely  not  conducted  was  to  carry  out  a  dry  run;  this 
may  have  occurred,  but  investigators  found  no  evidence  of  this.  Nevertheless,  the  terrorists  could 
have  conducted  their  attack  successfully  based  on  the  steps  they  did  carry  out. 

The  plan  to  attack  was  interrupted,  however,  because  on  the  evening  before  the  planned  attack, 
Mezer  showed  the  devices  to  one  of  the  other  Arab  immigrants  residing  in  the  apartment  and  told 
him  of  the  plan  to  detonate  the  devices  on  the  train  the  next  day.  That  man,  an  Egyptian 
immigrant  named  Abdelrahman  Mossabeh,  did  not  support  the  plan  and  was  concerned  that,  as 
their  roommate,  he  would  be  implicated  and  arrested.  Mossabeh  left  the  apartment  and  notified 
police.119  Mossabeh  gave  the  police  a  key  to  the  apartment,  diagrammed  its  layout,  and 
accompanied  them  to  the  location.120  The  police  entered  the  dark  apartment,  and  a  struggle 
ensued  during  which  both  Mezer  and  Khalil  were  wounded;  police  later  indicated  that  the  pair 
attempted  to  detonate  the  devices  during  the  raid.121 

Consequences 

From  the  perspective  of  the  two  would-be  terrorists,  the  impact  of  this  activity  was  negligible. 

The  attack  was  not  initiated,  and  hence  the  weapon  never  caused  casualties  or  material  damage. 

There  was  no  system  disruption.  There  was  moderate  national  media  coverage  that  ran  for  days 
after  the  incident  and  during  the  trial.  The  plot  was  not  aimed  at  a  symbolic  target. 

It  is  not  clear  that  the  plan  had  a  strategic  objective.  Taking  that  into  account,  the  psychological 
impact  can  be  characterized  as  low.  No  survey  data  are  available  to  indicate  the  reaction  of  New 
Y orkers  to  this  threat  to  the  subway  system,  but  it  most  likely  had  some  shock  value  as  the  plot 
nearly  entered  the  execution  phase.  However,  the  psychological  impact  was  not  so  severe  that  it 
kept  New  Yorkers  from  continuing  to  use  the  train  system.  There  was  no  economic  impact,  since 
no  businesses  or  business  sectors  suffered  from  the  event.  There  were  no  changes  in  U.S.  foreign 
policy  or  security  procedures  as  a  result  of  the  plot.  Finally,  there  are  no  survey  data  regarding  the 
impact  of  the  plot  on  supporting  population,  but  anecdotal  evidence  indicates  that  it  was  neutral  at 
best.  There  were  no  immediate  follow-on  plots  that  appeared  to  be  inspired  by  this  attempt,  and  in 
fact,  the  person  who  reported  the  plot  to  police  would  be  considered  a  member  of  the  population 
to  whom  Mezer  and  Khalil  would  look  for  support. 
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Factors  Associated  With  Success  or  Failure 

The  outcome  of  this  plot  is  associated  with  a  number  of  factors. 

Training :  This  was  a  relatively  simple  operation  and  as  such  required  little  specialized  training  or 
mastery  of  complex  skills.  One  exception  might  be  the  design  and  assembly  of  the  weapon,  which 
is  covered  separately  in  the  next  category.  Both  Mezer  and  Khalil  seemed  proficient  in  the  roles 
they  were  to  carry  out,  specifically  deploying  to  the  station  undetected  and  initiating  the 
detonation  of  the  explosives. 

Technical  sophistication :  The  FBI  explosives  experts  confirmed  that  the  bombs  were  viable  and 
capable  of  killing  any  person  within  a  25-foot  radius  in  an  enclosed  space.122  Therefore,  it  can  be 
said  that  Mezer  and  Khalil  had  a  high  level  of  technical  sophistication. 

Operational  proficiency.  Since  the  attack  was  never  executed,  the  level  of  operational  proficiency 
of  Mezer  and  Khalil  is  unknown. 

Terrorist  profile  indicators'.  Mezer  clearly  had  a  background  warranting  interest  from  authorities: 
he  was  a  West  Bank  Palestinian  who,  by  his  own  statements,  indicated  a  tie  to  a  terrorist 
organization;  he  had  committed  crimes  while  in  Canada,  and  he  had  attempted  to  enter  the  United 
States  illegally  three  times.  Khalil,  on  the  other  hand,  would  not  have  raised  suspicions.  Although 
the  Ecuadorian  visa  upon  which  his  U.S.  visa  was  predicated  was  fraudulently  obtained,  he 
nonetheless  held  an  authentic  entry  stamp  for  the  United  States.  Furthermore,  despite  Mezer’s 
background,  both  he  and  Khalil  gave  the  impression  to  acquaintances  that  they  were  not  devout. 
Therefore  the  record  in  this  category  is  mixed,  with  one  of  the  members  warranting  suspicion  and 
the  other  not. 

Terrorist  OP SEC\  Of  all  factors,  operational  security  is  the  one  that  contributed  the  most  to  the 
failure  of  the  operation  at  all  three  levels.  Mezer’s  decision  to  boast  of  his  plan  to  a  non-vetted 
acquaintance  initiated  the  chain  of  events  that  prevented  the  operation  from  entering  the 
execution  phase;  had  it  done  so,  it  is  likely  that  the  operation  would  have  been  successful  on  at 
least  the  tactical  and  operational  levels.  The  failure  of  the  operation  due  to  this  single  factor 
indicates  that  success  or  failure  is  highly  sensitive  to  operational  security. 

Innovation'.  A  moderate  degree  of  innovation  was  present  in  this  plot.  While  pipe  bombs  had  been 
used  extensively  against  public  transport,  this  would  have  been  their  first  use  against  such  targets 
on  U.S.  soil. 

Technical  difficulties'.  The  terrorist  team  experienced  no  technical  difficulties,  as  evidenced  by  the 
fact  that  their  bombs  were  assembled  and  capable  of  working  as  designed. 

Law  enforcement  or  intelligence  knowledge'.  Up  until  the  informant  notified  police  of  the  plot,  the 
authorities  had  no  knowledge  of  the  plan.  As  in  many  cases,  events  played  into  the  hands  of  the 
authorities  when  Mossabeh  provided  the  threat  information.  Good  police  training,  reflected  in  the 
officers’  recognition  of  the  veracity  and  importance  of  that  information,  played  a  crucial  role  in 
capitalizing  on  that  lead.  That  said,  the  fact  that  either  got  into  the  country  highlights  serious 
weaknesses  in  U.S.  entry  control  procedures  at  that  time. 

Security  environment :  The  environment  in  the  United  States  in  1997  could  be  characterized  as 
between  moderately  restrictive;  law  enforcement  and  intelligence  agencies  were  cognizant  of  the 
threat  of  terrorist  attacks  in  the  United  States  (after  the  World  Trade  Center  bombing,  the 
destruction  of  the  Murrah  building,  and  other  incidents).  However,  there  were  few  specific  anti- 
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terror  laws,  programs,  or  practices  in  place  at  that  time  as  compared  to  the  post-2001 
environment. 

Effective  information  sharing :  This  attempted  attack  might  have  been  defeated  even  earlier  had 
the  plotters  been  denied  entry  to  the  United  States  or  deported  for  illegal  entry.  Both  men’s  cases 
highlight  a  lack  of  communication  and  understanding  of  roles  in  the  immigration  and  asylum 
processes.  The  immigration  court  considering  Mezer’s  asylum  application  believed  that  the  State 
Department  had  checked  for  information  on  potential  ties  to  terrorist  organizations,  while  the 
State  Department  believed  that  the  Immigration  and  Naturalization  Service  had  enough 
information  in  its  database  to  make  its  own  determination.123  In  Khalil’s  case,  neither  the 
Consular  Officer  in  Jerusalem  nor  the  immigration  officer  at  the  airport  considered  it  his 
responsibility  to  ask  to  see  a  ticket  to  Ecuador;  furthermore,  neither  considered  it  his 
responsibility  to  limit  time  permitted  in  the  United  States  to  less  than  the  maximum  29  days,  even 
though  Khalil  stated  he  would  be  in  the  United  States  only  long  enough  to  transfer  to  a 
connecting  flight.124  Had  standard  operating  procedures  made  roles  and  responsibilities  clear,  and 
information  shared  appropriately,  it  is  less  likely  that  either  man  would  have  gained  entry  to  the 
United  States. 

There  was  effective  information  sharing,  however,  at  the  tactical  level.  The  officers  approached 
by  Mossabeh  were  with  the  Transit  Police;  they  recognized  the  importance  of  passing  the 
information  outside  their  organization  and  transported  Mossabeh  to  the  New  York  Police 
Department’s  88th  Precinct,  and  eventually  the  special  tactics  unit  was  given  control.125 

International  cooperation :  International  cooperation  was  lacking.  The  State  Department  and  the 
Immigration  and  Naturalization  Service  did  not  seek  information  from  Canada  or  Israel  regarding 
terrorist  ties,  nor  did  they  confirm  through  Ecuadorian  authorities  Khalil’s  intent  to  travel  there. 

Findings 

As  with  many  terrorist  attempts,  the  New  York  City  subway  plot  exhibits  a  mix  of  factors  that 
could  be  associated  with  a  successful  operation  and  those  that  could  lead  to  failure.  What  is 
revealing,  however,  is  that  in  this  case,  the  overwhelming  majority  of  factors  were  working  in 
favor  of  the  terrorists,  and  yet  the  single  factor  impacting  failure — poor  operational  security — had 
more  influence  on  the  outcome  of  the  plan  than  all  of  the  other  factors.  Had  Mezer  not  boasted  of 
the  plot  and  shown  an  assembled  weapon  to  an  unvetted  acquaintance,  and  had  the  police  not 
acted  upon  the  tip  received  from  the  acquaintance,  in  all  likelihood,  the  many  factors  associated 
with  success  would  have  led  to  execution  of  the  plan.  This  suggests  that  terrorist  plans  are  very 
sensitive  to  this  particular  factor. 

Poor  OPSEC,  in  and  of  itself,  will  not  necessarily  lead  to  the  failure  of  a  plot.  Security  authorities 
must  be  able  to  capitalize  on  opportunities  that  poor  OPSEC  provides.  Mossabeh  provided  his 
information  to  two  inexperienced  police  officers  who  had  difficulty  understanding  him  due  to 
language  difficulties.126  However,  they  took  this  information  seriously  and  ensured  that  it  was 
passed  to  other  authorities  who  could  act  upon  it. 
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London  Transit  Bombings — July  7,  2005 

Overview 

During  the  morning  rush  hour  in  downtown  London,  four  terrorists  detonated  homemade  bombs 
on  the  Underground  subway  system  and  on  a  commuter  bus.  In  addition  to  the  bombers,  52 
people  were  killed  and  over  700  were  injured.127  Although  the  British  had  experienced  bombings 
for  an  extended  period  by  the  Irish  Republican  Army,  this  was  the  first  terrorist  incident  in  the 
U.K.  since  the  September  11,  2001  attack  in  the  United 
States  and  the  first  connected  to  radical  Islam.  The  entire 
Underground  system  was  shut  down  for  hours,  creating 
moderate  disruption  for  commuters  after  the  attacks.  At 
that  time  of  day,  the  Tube  is  typically  carrying  over 
200,000  passengers  on  500  trains.128  Those  200,000 
passengers,  along  with  2,500  staff,  were  evacuated  in 
under  an  hour.129 

Within  days,  British  authorities  had  identified  the  four  terrorists,  three  of  whom  were  native 
Britons  and  one  an  immigrant  from  Jamaica  who  had  converted  to  Islam.130  In  May  2007, 
evidence  emerged  that  possibly  tied  this  plot  to  a  senior  al  Qaeda  planner  named  Abdul  Hadi  al- 
Iraqi.  This  was  revealed  at  the  end  of  the  trial  of  six  other  Britons  accused  of  plotting  to  conduct  a 
bombing  campaign  using  explosives  made  from  fertilizer.  Those  court  records  indicate  both  plots 
may  have  been  directed  by  al  Iraqi.131 

Significance  of  the  Incident 

This  attack  marked  an  important  shift  in  the  model  of  terrorist  attacks  in  the  West.  Until  this 
point,  terrorist  attacks  were  almost  exclusively  conducted  by  outsiders — either  immigrants 
residing  in  a  target  country  or  terrorists  who  arrived  specifically  to  conduct  an  attack.  After  this 
event,  Western  security  services  began  to  consider  homegrown  terrorists  a  threat  and  to  evaluate 
the  degree  to  which  locally  raised  members  of  ethnic  or  religious  minorities  were  integrated  into 
or  alienated  from  the  society  in  which  they  live. 

Significantly,  this  incident  was  the  first  in  the  U.K.  involving  a  suicide  attack;  most  previous 
attacks  had  been  conducted  by  the  Irish  Republican  Army,  using  remotely  detonated  or  time- 
detonated  bombs  and  mortars. 

Finally,  along  with  attacks  in  Moscow,  Madrid,  and  Mumbai,  the  attack  demonstrates  the  intent 
and  capability  of  terrorists  to  strike  passenger  rail  and  subway  systems.  In  fact,  the  London 
operation  may  represent  a  case  of  terrorist  learning  from  observations.  The  high  number  of 
casualties  inflicted  in  the  attacks  in  Spain  and  Russia  may  have  demonstrated  to  those  planning 
these  bombings  the  vulnerability  of  the  transit  system  to  catastrophic  attack.  Likewise,  the  attack 
in  Mumbai  in  2006  could  have  been  inspired  by  the  strategic  impact  of  the  bombings  in  London 
and  elsewhere. 

Description  of  the  Group  or  Individuals  Involved 

Background  of  the  Bombers 


Type  of  Attack:  Detonation  of 
homemade  bombs  aboard  London 
Underground  system 
Date:  July  7,  2005,  during  morning 
rush  hour 

Group  Involved:  Four  young 
Muslim  men  who  were  British  citizens 
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The  attack  cell  was  composed  of  four  individuals  from  the  West  Yorkshire  area.  The  oldest,  and 
apparent  leader,  was  30-year-old  Mohammed  Sidique  Khan.133  The  youngest  of  six  children, 

Khan  was  bom  in  the  U.K.  to  Pakistani  immigrants.134  He  was  considered  quiet  and  studious  in 
his  early  years.  He  studied  business  at  Leeds  Metropolitan  University  and  was  married  to  a 
British  Muslim  of  Indian  heritage.135  Considered  “highly  Westernized”  by  acquaintances,136  he 
worked  at  a  local  school  with  special-needs  children  and  those  with  behavioral  issues.  He  was 
considered  a  role  model,137  but  after  a  long  period  of  sick  leave — considered  excessive  by  school 
administrators — he  was  fired  from  that  position. lj8  While  still  employed  at  the  school,  he  was 
openly  religious,  praying  at  work  and  attending  mosque  regularly.139  However,  he  did  not  espouse 
violence  or  radicalism,  and  spoke  out  against  the  9/1 1  attacks.140  In  hindsight,  some 
acquaintances  from  that  period  report  a  subtle 
change  in  his  character  around  2002,  when  his 
behavior  became  less  tolerant  and  he  seemed  more 
introverted.141  It  is  known  that  Khan  traveled  to 
Karachi,  Pakistan,  in  2004  (with  one  of  the  other 
conspirators,  Shehzad  Tanweer),142  and  he  may 
have  received  some  training  at  al  Qaeda  camps  in 
Afghanistan  at  some  point  as  well. 143  In  fact, 
testimony  from  the  trial  of  the  Britons  accused  of 
plotting  to  make  fertilizer  bombs  indicates  Khan 
trained  with  at  least  one  of  those  conspirators  at  an 
al  Qaeda  camp  in  late  2004. 144 

Like  Khan,  22-year-old  Shehzad  Tanweer  was  born  in  the  U.K.  and  was  the  son  of  Pakistani 
immigrants.145  He  also  attended  Leeds  Metropolitan  University,  in  his  case  to  study  sports 
science,146  but  left  before  earning  a  degree.147  After  he  left  the  university,  he  worked  at  his 
father’s  fish  and  chips  shop. 148  He  had  been  very  religious  since  his  late  teens,  but  never  exhibited 
extremism  in  his  statements  or  behavior.149  His  religion,  moreover,  did  not  interfere  with  his 
British  identity;  in  addition  to  working  in  the  fish  and  chips  shop,  he  was  an  avid  cricket  and 
football  player  and  was  described  by  acquaintances  as  “more  British  than  anything  else.”150  As 
mentioned  above,  he  traveled  to  Pakistan  with  Khan  and  may  have  attended  training  camps  in 
Afghanistan.151 

The  other  native  Briton  and  youngest  of  the  group  was  18-year-old  Hasib  Hussain.  The  youngest 
of  four  children,  he,  like  Tanweer  and  Khan,  was  born  in  the  U.K.  to  Pakistani  parents.152  In 
2002,  he  participated  in  the  hajj  with  his  family;  this  seems  to  have  been  a  turning  point  for  him, 
as  after  his  return  he  began  to  wear  traditional  clothing  and  a  prayer  cap,  and  on  Fridays  he  would 
wear  white.153  Unlike  the  others,  he  began  to  espouse  support  for  extremism,  including  writing 
the  phrase  “Al  Qaeda  No  Limits”  on  a  school  notebook  and  referring  to  the  9/11  bombers  as 
martyrs.154  He  did,  however,  switch  back  to  Western  clothing  in  late  2004;  although  the  reason 
for  this  change  is  not  known,  there  is  speculation  that  he  was  trying  to  become  less 
conspicuous.155 

Jermaine  Lindsay  was  the  only  conspirator  not  native  to  the  U.K.  The  1 9-year-old  was  bom  in 
Jamaica  and  had  little  contact  with  his  birth  father.  Less  than  a  year  after  his  birth,  he  moved  with 
his  mother  and  another  man  to  the  U.K.156  In  2000,  when  he  was  14,  his  mother  converted  to 
Islam.  Lindsay  himself  converted  shortly  thereafter.  He  had  always  been  a  good  student,  and  the 
ease  with  which  he  learned  Arabic  and  memorized  passages  from  the  Koran  impressed  his 


The  Support  Cell 

Twenty  months  after  the  attack,  British 
authorities  arrested  three  men  believed  to  have 
been  connected  to  the  July  7  bombings.  Two 
were  living  in  the  Beeston  area  of  Leeds  at  the 
time  of  the  arrests.  These  were  thirty-year-old 
Mohammed  Shakil  and  Sadeer  Saleem,  age  26. 
The  third,  Waheed  Ali,  had  lived  most  of  his 
life  in  Beeston  but  had  moved  to  east  London; 
he  was  also  known  as  Shipon  Ullah.  As  of  mid- 
May  2007,  their  exact  role  in  the  bombing  was 
unknown.  British  authorities  stated  that  further 
arrests  were  expected.132 _ 


33 


Underlying  Reasons  for  Success  and  Failure  of  Terrorist  Attacks 


acquaintances.157  However,  he  did  begin  to  espouse  extremist  philosophy  and  was  disciplined  in 
school  for  handing  out  leaflets  in  support  of  al  Qaeda.  He  was  a  follower  of  a  particularly  radical 
cleric  named  Abdallah  al  Faisal,  also  a  Jamaican,  who  was  eventually  jailed  for  inciting  murder 
and  racist  violence.158  In  2002,  at  age  17,  Lindsay  was  traumatized  by  his  mother’s  move  to  the 
United  States,  leaving  him  alone  back  in  the  U.K.  However,  he  settled  down  and  married  a  white 
British  convert  whom  he  met  on  the  Internet  and  later  met  in  person  at  a  “Stop  the  War”  protest 
against  the  planned  invasion  of  Iraq.  Their  first  child  was  bom  in  April  2004. 159  In  contrast  to  the 
others,  whose  behavior  generally  did  not  arouse  suspicion  before  the  bombings,  Lindsay 
exhibited  erratic  behavior  beginning  in  November  2004.  According  to  the  “Report  of  the  Official 
Account”  into  the  bombings  commissioned  by  the  House  of  Commons,  he  was  sometimes 
violent,  became  flirtatious  (having  previously  been  very  conservative  in  contacts  with  women), 
shaved  his  beard,  and  reverted  to  Western  clothing.  He  is  known  to  have  had  at  least  one  mistress, 
perhaps  more.  When  his  wife  discovered  incriminating  text  messages  on  his  cellular  phone,  she 
forced  him  to  leave  their  house.160 

Formation  of  the  Cell 

It  appears  that  Khan  was  the  ringleader  of  this  group  and  that  the  others  were  drawn  to  him 
through  his  charismatic  personality  while  working  at  youth  centers  or  at  the  local  gym.  Whether 
or  not  they  were  previously  disposed  toward  violence,  Khan  appears  to  be  the  leader  around 
whom  the  others  rallied.161  The  conspirators  also  took  an  interest  in  outdoor  activities,  such  as 
whitewater  rafting,  which  provided  further  opportunities  for  bonding  and  indoctrination  away 
from  the  public  eye.162  Although  no  connection  has  been  proven,  it  is  interesting  that  some  of  the 
participants  in  the  failed  plot  on  July  21,  2005  may  have  also  attended  that  whitewater  rafting 
camp.163 

The  most  telling  commonality  among  the  four  is  that  they  were  all  native  to  Britain  or  immigrated 
in  their  early  childhood  and  generally  speaking  did  not  exhibit  any  behaviors  that  would  have 
brought  them  to  the  attention  of  authorities.  At  the  time,  most  Western  intelligence  and  law 
enforcement  agencies  were  concentrating  on  radicals  who  had  migrated  to  Western  countries;  this 
was  the  type  of  terrorist  who  had  attempted  most  previous  attacks,  including  (  among  others)  the 
World  Trade  Center  attack  in  1993,  the  Bojinka  plot,  the  September  1 1  attacks,  and  the  train 
bombings  in  Madrid.  These  homegrown  terrorists,  therefore,  were  able  to  operate  with  greater 
latitude  than  others  who  met  the  standard  profile  in  use  at  that  time. 

Motivation 

The  four  conspirators  seemed  to  be  fairly  well  integrated  into  British  society  and,  with  few  minor 
exceptions,  did  not  seem  interested  in  terrorism.  However,  each  of  them  reached  a  turning  point 
that  altered  their  identity  and  sense  of  justice. 
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There  is  little  concrete  information  regarding  the  terrorists’  motivation.  The  primary  sources  are 
martyrdom  videos  made  by  Khan  and  Tanweer,  along  with  Khan’s  last  will  and  testament. 

Khan’s  September  2005  video  gives  perhaps  the  greatest  insight  into  his  specific  motivation 
toward  violent  action.  He  cites  perceived  injustices  inflicted  on  Muslims  around  the  world  by  the 
West.  He  views  civilians  in  democratic  countries  that  peipetuate  these  perceived  atrocities  as 
valid  targets,  since  they  lend  legitimacy  to  their  governments,  and  he  views  himself  as  “directly 
responsible  for  protecting  and  avenging  [his]  Muslim  brothers  and  sisters.”168  His  will  emphasizes 
the  religious  aspect  of  his  act  and  the  role  of  martyrdom  as  the  supreme  act  of  commitment.  He 
seems  to  borrow  heavily  from  the  will  of  a  British  national  killed  in  Afghanistan,  whom  he 
regarded  as  a  role  model.169 

Tanweer’ s  video,  released  a  year  after 
the  bombings,  is  more  specific:  he  cites 
British  and  American  operations  in 
Afghanistan  and  Iraq  as  his  motivation, 
claiming  that  bombings  would  continue 
until  British  forces  are  withdrawn  from 
those  countries.  He  also  specifies 
British  financial  and  military  support  to 
Israel  and  the  United  States  as 
justifications  for  his  actions.170 

Planning 

There  is  no  information  indicating  the 
specific  genesis  of  the  plan  or  whether 
it  was  initially  conceived  by  the  four 
suicide  bombers  or  from  an  outside 
entity  such  as  al  Qaeda.  Regardless, 
available  evidence  indicates  that  the 
operation  was  sophisticated  and  well 
planned. 

The  first  evidence  of  the  plan  is  the 
initial  purchase  of  materials  for  the 
bombs  on  March  3 1 ,  2005 . 1 7 1  In  May 
2005,  the  conspirators  rented  an 
apartment  next  to  the  Leeds  Grand  Mosque  to  use  as  a  bomb  factory,  away  from  their  normal 
residences.  The  apartment  was  located  in  the  Hyde  Park  area  of  Leeds,  which  was  inhabited 
mostly  by  students.  This  aided  their  operational  security,  since  they  would  not  be  recognized  and 
would  not  stand  out  in  this  neighborhood  of  young,  transient  men.172 

The  planning  also  included  at  least  one  reconnaissance  trip  or  dry  run  on  June  28,  2005.  Khan, 
Tanweer,  and  Lindsay  (but  not  Hussain)  were  seen  on  closed-circuit  TV  (CCTV)  making  the  trip 
that  they  would  make  again  nine  days  later,  taking  a  train  from  Luton  to  the  King’s  Cross  Station 
in  London,  from  which  they  transferred  to  the  Underground  system.  The  timing  of  the 
connections  was  approximately  a  half  hour  later  in  the  day  than  the  timing  for  the  actual  attack. 17j 
In  addition,  tickets  were  found  at  the  bomb  factory  apartment  suggesting  trips  to  London  in  mid- 


The  Role  of  al  Qaeda 

At  first,  there  was  no  clear  connection  between  al  Qaeda 
and  the  attacks  of  July  7,  2005.  Authorities  knew  Khan  and 
Tanweer  had  traveled  to  Pakistan;  however,  that  is  quite 
common  among  the  large  minority  of  Britons  of  Pakistani 
background  (estimated  at  approximately  750,000  in  April 
2001). 164 

It  wasn’t  until  May  2007  that  more  concrete  evidence  of  a 
connection  was  publicly  revealed.  A  separate  investigation, 
known  as  Operation  Crevice,  resulted  in  the  arrest  of  six 
Britons  for  plotting  to  attack  targets  in  the  U.K.  using 
bombs  fabricated  from  fertilizer.  Testimony  that  was  kept 
secret  until  after  the  trial  connected  those  plotters  to  the 
reputed  No.  3  leader  in  al  Qaeda,  Abdul  al  Iraqi.  According 
to  the  testimony,  Khan  trained  with  one  of  the  Crevice 
plotters  -  Omar  Khyam  -  at  an  al  Qaeda  camp  directed  by 
al-Iraqi.  165  It  should  also  be  noted  that  al  Qaeda  itself 
claimed  responsibility  for  the  attacks. 

A  video  made  by  Khan  was  broadcast  on  al  Jazeera  in 
September  2005,  accompanied  by  a  statement  from  al 
Qaeda’s  second-in-command,  Ayman  al  Zawahiri, 
asserting,  “London’s  blessed  raid  is  one  of  the  raids  which 
Jama’at  Qa’idat  al-Jihad  [al  Qaeda  of  Jihad  Group]  was 
honored  to  launch.”166  A  second  video  was  released  on  the 
anniversary  of  the  attack  in  2006;  this  was  Tanweer’s 
“martyrdom”  video,  edited  by  al  Qaeda  and  once  again 
including  a  statement  by  Zawahiri.167  These  tapes  suggest, 
but  do  not  conclusively  prove,  some  level  of  coordination 
or  support  from  al  Qaeda  to  the  bombers. 
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March;  such  trips  could  have  been  intended  to  gather  information  or  to  practice  routes  and 
timing.174 

There  is  no  information  to  confirm  or  refute  whether  the  terrorists  conducted  a  test  detonation  to 
validate  their  weapon  design. 

Attack 

The  Weapon 

Forensic  analysis  indicated  that  the  bombers  each  carried  a  homemade  peroxide-based  explosive. 
Such  explosives  require  care  to  manufacture,  owing  to  their  instability;  however,  they  are  not 
especially  difficult  to  assemble  and  can  be  created  with  readily  available  ingredients.175  Each 
weapon  contained  two  to  five  kilograms  of  explosives.176  While  the  bombers  could  have  found 
instructions  for  creating  these  weapons  in  open  sources,  British  authorities  believe  it  is  likely  that 
they  also  received  some  assistance  from  a  skilled  bomb  maker,  owing  to  the  volatility  of  the 
mixture.177  The  chemicals  used  were  also  very  strong,  requiring  the  use  of  masks  and  shower 
caps;  in  fact,  the  fumes  killed  portions  of  plants  just  outside  the  windows  where  the  mixing  took 
place.178 

Deployment 

There  is  considerable  documentation,  through  CCTV  footage,  of  the  deployment  phase  of  this 
attack. 

Deployment  began  early  in  the  morning  on  July  7,  when  three  of  the  bombers — Khan,  Tanweer, 
and  Hussain — were  seen  leaving  the  bomb  factory  in  Leeds  at  3:58  AM  in  a  rental  car.179  At  5:07 
AM,  Lindsay,  alone  at  this  point,  arrived  at  the  Luton  train  station  and  waited  in  the  parking  lot 
for  the  others  for  a  little  over  an  hour  and  a  half.180  When  the  others  arrived,  at  6:47  AM,  the  four 
donned  the  backpacks  containing  the  weapons  and  entered  the  train  station.  They  waited  at  the 
platform  for  approximately  20  minutes,  then  at  7:40  AM  caught  the  train  to  London’s  King’s 
Cross  Station.  Their  casual  clothes  and  backpacks  did  not  stand  out,  since  this  occurred  during  a 
period  of  heavy  tourist  travel  and  the  train  serviced  the  Luton  airport.  The  train  arrived  at  King’s 
Cross  just  before  8:30  AM,  and  the  four  transferred  from  the  rail  system  to  the  Underground. 
From  there  the  four  split  up  and  deployed  onto  the  trains  that  were  their  intended  targets.181 

Execution 

The  execution  phase  began  approximately  twenty  minutes  after  the  four  men  transferred  to  the 
Underground.  The  first  three  weapons  were  detonated  at  8:50  AM,  within  50  seconds  of  each 
other,182  attesting  to  a  high  degree  of  training,  coordination  and  discipline  by  the  bombers.  The 
fourth  bomb  was  detonated  nearly  an  hour  later  on  a  commuter  bus;  it  is  not  known  if  this  was 
according  to  the  plan  or  a  fallback  option  after  meeting  operational  or  technical  difficulties.183 

•  According  to  CCTV  images,  Tanweer  was  onboard  the  eastbound  Circle  Line  train  and 
detonated  the  device  as  it  approached  Aldgate  from  the  Liverpool  Street  station.  He  was 
likely  in  the  second  car  of  the  train,  toward  the  back  with  the  backpack  on  the  floor  next 
to  him.184 

•  Khan  was  in  the  second  car  from  the  front  on  the  westbound  Circle  Line  train  near  the 
Edgware  Road  station.  He  was  standing  near  the  first  set  of  doors,  also  with  the  bomb  on 
the  floor  next  to  him.185 
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•  Lindsay’s  target  was  the  Piccadilly  Line;  he  was  in  the  first  car  of  the  train  as  it  headed 
south  from  King’s  Cross  to  Russell  Square.  He  was  most  likely  standing  in  the  crowded 
car,  which  held  127  passengers  at  that  moment.  Forensics  indicate  again  that  the  weapon 
was  detonated  at  or  near  floor  level  between  the  second  and  third  rows  of  seats.186 

•  For  unknown  reasons,  Hussain  did  not  detonate  his  weapon  simultaneously  with  the 
others.  Instead,  at  8:55  AM,  he  was  observed  leaving  the  King’s  Cross  Underground 
Station  onto  Euston  Road.  After  several  unsuccessful  attempts  to  contact  the  others  by 
cell  phone,  he  re-entered  the  station  and  purchased  a  9-volt  battery  at  a  bookstore.  This 
might  indicate  a  technical  difficulty  with  the  weapon,  and  if  so,  it  indicates  good  training 
and  discipline  to  assess  and  correct  the  cause  of  the  malfunction.187  Hussain  then  took  a 
bus  to  Euston  Station  and  transferred  to  a  second  bus;  by  this  time,  the  Underground  had 
been  shut  down  so  buses  were  crowded.  When  the  bus  was  at  Tavistock  Square,  he 
detonated  the  device.  Like  the  others,  it  was  on  the  floor,  either  between  his  feet  or  in  the 
aisle  next  to  him.188 

•  As  stated  above,  there  is  no  conclusive  evidence  as  to  why  this  weapon  was  detonated  on 
a  bus  and  nearly  an  hour  after  the  others.  It  may  have  been  planned  that  way  to  continue 
the  sense  of  panic;  it  could  have  been  a  technical  malfunction,  necessitating  the  purchase 
of  the  battery;  or,  as  one  government  report  posited,  he  may  have  intended  to  go  north  on 
the  Northern  Line  (the  others  had  gone  east,  west  and  south  from  King’s  Cross),  but  been 
frustrated  by  delays  on  that  line.189 

Consequences 

The  impact  of  this  event  was  significant.  The  total  number  of  people  killed,  not  including  the 
bombers,  was  52,  with  over  700  injured.  The  casualties  by  location  are  as  follows:190 


Target  (Bomber) 

Killed 

Injured 

Aldgate  (Tanweer) 

7 

171 

Edgware  (Khan) 

6 

163 

Russell  Square  (Lindsay) 

26 

340 

Tavistock  (Bus)  (Hussain) 

13 

110 

In  addition  to  destroying  at  least  four  Underground  cars  and  a  bus,  the  explosion  also  nearly 
buckled  the  deep  tunnel  near  Russell  Square,191  which  is  70  feet  below  ground.192 

There  was  moderate  disruption  to  the  Underground  system.  The  system  was  completely  shut 
down  on  July  7,  but  was  running  at  80%  capacity  within  24  hours.  On  July  25,  the  Aldgate 
Station  was  back  in  operation,  and  Edgware  Road  was  operational  four  days  later.  Finally, 
Russell  Square  was  reopened  on  August  4. 193 

The  terrorists  did  draw  attention  to  their  “cause;”  media  coverage  was  extensive,  with  immediate 
breaking  news  coverage  worldwide  and  continuing  for  several  months.  This  event  was  also 
marked  by  widespread  inclusion  of  user-generated  content  with  photos  from  cell  phones  and 
other  information  from  the  many  sources  made  ubiquitous  by  today’s  personal  technology.194 
This  democratization  helped  make  the  events  seem  more  personal  to  news  consumers. 
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Although  the  Underground  might  be  considered  iconic  by  some,  it  is  not  a  symbolic  target  in  the 
way  that  the  Tower  of  London,  Buckingham  Palace,  or  other  symbols  of  British  identity  are; 
therefore,  we  do  not  consider  this  an  attack  on  a  symbolic  target. 

There  was  no  compromise  of  a  larger  terrorist  network;  either  no  such  network  existed  or  it  has 
not  been  detected. 

The  near  term  psychological  impact  of  this  event  for  transit  users  can  be  characterized  as  high. 
According  to  a  paper  published  in  the  British  Medical  Journal  in  August  2005,  3 1%  of 
respondents  indicated  significant  stress  (the  highest  category)  due  to  the  July  7  attack.  Thirty 
percent  responded  that  they  would  decrease  use  of  the  Underground,  and  46%  stated  that  they  felt 
unsafe  on  the  Underground  system.195  By  mid-September  ridership  on  the  Underground  was  back 
at  2004  levels.196  The  psychological  impact  that  this  attack  has  in  the  long-term  remains  to  be 
seen,  but  it  is  likely  that  the  adverse  effects  will  continue. 

Economic  impact  was  moderate;  pedestrian  traffic  in  the  West  End  went  down  20%  to  30%  in  the 
two  weeks  following  the  attacks;  in  addition,  a  survey  of  more  than  50  British  business  owners 
indicated  that  21%  of  respondents  said  they  would  change  plans  to  visit  London  after  the 
attack.197  On  the  other  hand,  the  London  Chamber  of  Commerce  reported  that  all  member 
businesses  were  back  to  full  operations  in  two  days  at  most.198  The  Royal  Mail,  for  example, 
experienced  disruptions  during  the  day — and  with  at  least  25%  of  British  mail  transiting  London, 
this  had  nationwide  impact.  However,  according  to  the  Royal  Mail’s  response  to  queries  by  the 
London  Chamber  of  Commerce,  it  was  “very  quickly  able  to  recover”  and  “in  many  cases 
services  were  being  resumed  during  the  afternoon  and  evening  of  7  July  and  deliveries  were  made 
as  usual  the  following  morning.”199 

The  strategic  impact  on  the  government  was  reflected  directly  in  changes  to  antiterrorist  legal 
legislation.  Proposals  introduced  in  the  month  after  the  bombing  created  new  offenses  related  to 
planning  terrorist  attacks  and  proposed  a  controversial  national  identification  card.200  Many 
Britons  felt  this  to  be  an  over-reaction  that  played  into  the  hands  of  the  terrorists  by  limiting  civil 
rights;  Human  Rights  Watch,  in  particular,  objected  to  the  proposal  to  extend  the  period  of 
detention  without  charge,  from  14  days  to  90,  stating  that  it  “seriously  undermines  the  right  to  a 
fair  trial,  the  presumption  of  innocence,  and  the  right  of  an  arrested  person  to  be  informed 
promptly  of  any  charge  against  him.”201 

The  attacks  had  a  generally  negative  impact  on  the  terrorists’  support  population.  In  a  Populus 
poll  conducted  for  the  London  Times  one  year  after  the  attack,  56%  of  the  1,131  British  Muslims 
surveyed — higher  than  the  49%  indicated  by  the  general  population — felt  their  government  had 
not  done  enough  to  combat  terrorism.  Furthermore,  49%  of  British  Muslims  felt  that  the 
government  should  be  allowed  to  monitor  events  in  mosques  to  anticipate  and  thwart  extremist 
violence.  However,  the  same  poll  found  that  over  10%  of  the  Muslims  surveyed  considered  the 
bombers  to  be  martyrs,  and  16%  (“equivalent  to  more  than  150,000”  Muslims)  felt  that  the 
attacks  were  wrong,  but  that  the  cause  was  just.202 

Significantly,  the  tip  that  started  the  investigation  into  the  August  2006  plot  to  destroy  U.S. 
airliners  came  shortly  after  the  July  7  bombings.  The  informant,  in  the  wake  of  the  London 
attacks,  raised  concerns  about  an  acquaintance  to  police.205 

Just  as  terrorist  organizations  learn,  so  do  security  services.  For  example,  after  London  suffered  a 
series  of  IRA  bomb  attacks  in  the  1980s  and  1990s,  British  authorities  emplaced  closed-circuit 
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television  (CCTV)  cameras  throughout  the  city.  These  did  not  prevent  the  2005  bombings,  but 
they  were  instrumental  in  identifying  the  bombers  and  tracking  their  movements  before  the 
attack.  In  the  future,  they  could  be  used  to  identify  suspicious  behavior.204  After  the  2005 
bombings,  London,  New  York,  and  other  cities  began  random  bag  searches  as  a  means  of 
deterring  the  use  of  backpack  bombs.205  As  another  example,  the  Washington  Metropolitan  Area 
Transit  Authority  (WMATA)  implemented  a  series  of  measures  in  direct  response  to  the  London 
transit  bombings.  These  include  the  use  of  Explosives  Detection  Canine  Teams,  increased  joint 
patrols  by  area  police  authorities,  increased  tunnel  inspections,  and  training  for  transit  employees 
and  law  enforcement  officers  in  spotting  suspicious  behavior  or  indications  of  impending 
attack.206  These  measures  can  add  a  degree  of  uncertainty  to  terrorist  planning  and  possibly  deter 
an  attack,  but  it  is  difficult  to  determine  the  exact  extent  of  their  effectiveness. 

Factors  Associated  With  Success  or  Failure 

The  following  factors  are  associated  with  the  outcome  of  this  incident: 

Training :  The  terrorists  clearly  were  well  trained.  They  executed  a  simultaneous  attack,  with  one 
possible  flaw  (the  fourth  bomb).  Hasib  Hussain  was  able  to  detonate  the  fourth  bomb  at  a  later 
time  and  complete  the  attack  objective. 

Technical  sophistication :  The  bombers  possessed  the  level  of  technical  sophistication  required  to 
prepare  for  this  attack.  The  first  three  bombs  functioned  as  designed,  and  the  fourth  eventually 
detonated  as  well. 

Operational  proficiency.  Khan,  Tanweer,  and  Lindsay  were  all  able  to  deploy  to  their  targets  and 
detonate  the  bombs  near  simultaneously.  It  is  not  clear  whether  the  delay  in  use  of  the  fourth 
device  was  due  to  a  technical  flaw;  but  even  if  it  was,  the  ability  to  identify  and  repair  the  fault 
indicates  a  high  level  of  operational  proficiency. 

Terrorist  profile  indicators'.  Generally  speaking,  none  of  the  four  bombers  had  anything  in  his 
background  that  would  make  him  a  priority  target  for  law  enforcement.  The  exception  is  the 
association  of  Tanweer  and  Khan  with  suspects  in  the  previously  mentioned  fertilizer  bomb  plot; 
however,  they  were  assumed  to  be  petty  criminals  not  involved  in  terrorism  and  were  never 
investigated  or  identified  by  name  until  after  the  July  bombings. 

Terrorist  OPSEC :  Terrorist  OPSEC  was  good.  The  Parliamentary  Report  specifically  stated  that 
“the  group  showed  good  security  awareness  and  planning  discipline.”207 

Innovation :  The  attack  was  unusual,  but  not  unprecedented;  while  there  had  been  high-profile  rail 
attacks  in  the  past  (notably  Madrid),  this  was  the  first  suicide  attack  in  Western  Europe  in  recent 
years,  and  the  use  of  homegrown  terrorists  was  an  innovation  that  increased  the  likelihood  of 
success. 

Technical  difficulties'.  The  bombers  experienced  few,  if  any,  technical  difficulties.  It  is  unclear 
whether  there  was  a  problem  with  the  fourth  device;  but  if  there  was  a  problem,  it  was  quickly 
overcome. 

Law  enforcement  or  intelligence  knowledge :  Law  enforcement  and  security  officials  had  no 
knowledge  of  the  plan  until  it  was  executed. 

Security  environment.  The  security  environment  in  the  U.K.  at  the  time  could  be  characterized  as 
a  complex  mix  of  permissive  and  restrictive  attributes.  On  the  one  hand,  Britain’s  experience  with 
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the  Irish  Republican  Army  had  resulted  in  a  more  restrictive  environment  than  most  democracies; 
on  the  other  hand,  the  U.K.  was  regarded  by  many  other  countries  as  overly  permissive  toward 
extremist  ideologues  among  its  Muslim  community.208 

Effective  information  sharing :  Information  sharing  among  British  authorities  was  ineffective;  MI5 
failed  to  follow  up  on  reports  tying  Khan  and  Tanweer  to  known  terrorists.  However,  this  could 
be  attributed  as  much  to  a  lack  of  resources  as  to  failure  to  share  information. 

International  cooperation :  International  cooperation  was  lacking.  There  was  no  known  exchange 
of  information  between  Pakistani  and  British  security  services  regarding  Tanweer  and  Khan’s 
presence  in  Pakistan. 

Obsen’ant public  and/or  vigilant  security  sendees:  There  is  only  one,  unconfirmed,  report 
regarding  a  tip  from  a  member  of  the  public.  A  computer  expert  named  Martin  Gilbertson 
claimed  to  have  notified  police  in  2003  that  Khan  and  Tanweer  had  asked  him  to  create  an  email 
encryption  program  and  firewall,  presumably  to  mask  their  activities  from  authorities.  West 
Y orkshire  Police  state  that  they  have  no  record  of  this  incident.  If  it  did  occur,  this  would  be  an 
informative  case  of  a  lucky  break  falling  into  the  hands  of  security  services,  upon  which  they 
failed  to  act,  possibly  missing  an  opportunity  to  halt  the  attack. 

Other  factors:  Other  factors  can  be  identified  that  impacted  the  outcome  of  this  plot: 

Location  of  attack:  The  damage  inflicted  in  the  deepest  tunnel,  near  Russell 
Square,  was  far  greater  than  in  the  shallower  tunnels  and  therefore  had  greater 
impact  at  the  tactical  level.  All  three  train  bombs,  however,  caused  great  damage 
due  to  the  enclosed  design  of  the  rail  cars. 

Method  of  attack:  This  attack  combined  two  tactics  that  increased  the  likelihood 
of  success.  First,  the  terrorists  attacked  a  major  subway  system  at  rush  hour.  This 
is  extremely  difficult  to  defend  against,  due  to  the  previously  mentioned 
vulnerability  of  limited  screening  and  open  system  architecture.  Second,  and 
unlike  the  Madrid  operation,  this  was  a  suicide  attack;  no  exit  strategy  was 
required  for  the  attackers,  and  command  detonation  enabled  the  bombers  to 
ensure  that  the  devices  were  not  moved  or  discovered  prior  to  detonation.  In  the 
words  of  RAND’s  Bruce  Hoffman,  “there  is  no  other  type  of  attack  that  is  more 
effective  than  suicide  terrorism.”209  As  the  Chief  Operating  Officer  of  the  London 
Underground,  Michael  Brown,  stated,  “the  phenomenon  of  the  suicide  bomber 
means  any  traditional  measures  of  detection  and  interception  are  therefore  likely 
to  be  ineffective.”210 

Simplicity:  Although  the  execution  of  the  plan  was  relatively  complex,  the 
planning  and  actions  prior  to  execution  were  relatively  simple.  A  small  number 
of  individuals  were  directly  involved,  making  OPSEC  easier  to  maintain.  The 
materials  used  were  commonly  available  and  inexpensive;  therefore  the  logistics 
and  financing  did  not  rise  to  a  level  to  cause  suspicion  or  create  operational 
difficulties. 

Lack  of  resources  by  security  services:  Khan  and  Tanweer  had  been  identified  as 
possibly  involved  in  terrorist  activity,  but  MI5  specifically  stated  that  a  lack  of 
resources  prevented  them  from  following  through  on  leads  that  did  not  present  an 
immediate  threat.  At  the  time  of  the  attack,  funding  had  been  authorized  to 
increase  the  MI5  staff  by  1,000,  but  the  results  had  not  yet  been  realized.21 1 
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Failure  to  capitalize  on  fortuitous  information'.  Many  terrorist  plots  are  thwarted 
when  a  piece  of  important  information  unexpectedly  comes  to  the  attention  of 
authorities.  The  Bojinka  plot,  the  planned  attack  on  the  subway  in  Brooklyn,  and 
the  liquid  explosives  plot  were  all  uncovered  when  security  and  law  enforcement 
forces  recognized  the  value  of  such  information  and  investigated.  If  Martin 
Gilbertson’s  claim  to  have  tipped  off  police  in  2003  is  true,  this  would  illustrate 
the  converse — that  lack  of  attention  to  unexpected  information  will  likely  lead  to 
a  missed  opportunity  to  thwart  an  attempted  terror  attack. 

Findings 

Many  factors  led  to  the  tactical,  operational,  and,  to  a  certain  extent,  strategic  success  of  this 
attack. 

First,  the  plotters  did  not  fit  the  profile  of  the  presumed  terrorist.  They  were  all  bom  in  the  U.K. 
or  lived  there  for  most  of  their  lives  and  were  viewed  by  those  who  knew  them  as  well-integrated 
into  British  society.  They  did  not  arouse  suspicion  when  they  boarded  the  trains,  as  their  clothing, 
accents,  and  manner  marked  them  all  as  natives.  Furthermore,  suicide  attacks  were  not  anticipated 
as  none  had  occurred  in  the  past. 

Surprise  was  also  aided  by  good  operational  security.  The  size  of  the  group  and  simplicity  of  the 
pre-execution  activity  certainly  enhanced  OPSEC,  but  the  bombers  also  practiced  discipline  in 
carrying  out  their  activities  away  from  those  who  would  ask  questions  and  in  not  confiding  their 
plans  to  anyone  outside  the  attack  cell.  There  were  some  breaches  in  OPSEC,  notably  the 
identification  of  Khan  and  Tanweer  by  MI5  and  the  alleged  contact  with  Gilbertson,  but  security 
authorities  were  unable  to  capitalize  on  these  fortuitous  opportunities. 
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Attempted  London  Transit  Bombings — 
July  21,  2005 

Overview 

Exactly  two  weeks  after  the  first  suicide  attack  on  the  London  Underground,  a  similar  attack  was 
attempted  by  another  small  cell  of  radical  Islamists.  This  attempt,  resulted  in  no  casualties 
because  the  main  charge  of  the  weapons  failed  to  detonate.  Three  stations  of  the  London 

Underground  and  one  bus  were  targeted,  similar  to  the  July  7 
attack.  A  fifth  bomb  was  found  abandoned,  apparently  because 
the  terrorist  assigned  to  use  that  weapon  lost  his  nerve,  and  the 
intended  target  for  that  weapon  is  unknown. 

After  an  initial  sweep  arrested  over  40  persons  believed 
connected  to  the  plot,212  British  authorities  eventually  charged 
six  suspects:  five  who  were  to  be  bombers  and  one  person  in  a 
support  role.213 

Significance  of  the  Incident 

Together,  the  two  July  attacks  marked  the  initial  use  of  suicide  bombs  in  the  U.K.,  as  well  as  the 
targeting  of  the  vulnerable  transit  system. 

Two  other  aspects  of  this  plot  make  it  useful  to  study.  First,  because  this  attack  failed,  it  is  useful 
to  contrast  it  with  the  more  successful  attack  two  weeks  earlier  to  determine  whether  there  are  any 
variations  in  the  plot  to  which  the  divergent  outcomes  could  be  attributed.  Second, 
notwithstanding  the  failure  of  the  bombs  to  detonate,  the  terrorists  were  able  to  deploy 
successfully  to  their  targets  despite  the  increased  awareness  of  the  threat  and  heightened  security. 

Description  of  the  Group  or  Individuals  Involved 

Unlike  the  bombers  in  the  earlier  attack,  the  men  involved  in  this  plot  were  not  native  to  the  U.K.; 
most  were  immigrants  from  the  Horn  of  Africa,  although  they  had  been  residents  of  Great  Britain 
for  years  and  in  some  cases  held  British  citizenship. 

The  apparent  ringleader  was  Muktar  Said  Ibrahim.  Ibrahim,  27  at  the  time  of  the  attempted 
attack,214  had  lived  in  the  U.K.  for  15  years.  His  family  had  emigrated  as  refugees  from  Eritrea.215 
He  left  home  at  age  16  and  apparently  was  not  close  to  his  family.  He  was,  however,  very 
religious,  according  to  reports  from  acquaintances.216  In  contrast  with  the  July  7  bombers, 

Ibrahim  had  exhibited  antisocial  behavior  as  early  as  high  school217  and  had  a  significant  criminal 
past — in  1 996,  he  was  sentenced  to  five  years  in  prison  for  participating  in  gang-related  robberies 
(he  was  granted  early  release  in  1998).  Apparently,  Ibrahim  became  devout  while  in  prison.218  He 
became  a  British  citizen  in  September  2004,  only  10  months  before  the  attempted  attack.219 

Yassin  Hassan  Omar  was  24  at  the  time  of  the  plot.220  Omar  was  a  Somali,  but  like  Ibrahim,  he 
came  to  the  U.K.  in  his  pre-teens  as  a  child  refugee  and  lived  in  state  housing.221  Eight  years  later, 
at  age  19,  he  was  given  permission  to  remain  indefinitely.222  At  one  point,  Omar  and  Ibrahim 
shared  an  apartment  in  north  London.  This  apartment,  at  58  Curtis  House,  New  Southgate,  later 
served  as  the  bomb  factory  for  this  plot. 223 


Type  of  Attack:  Planned 
detonation  of  homemade  bombs 
aboard  London  Underground 
system 

Date:  July  21,  2005,  around 
lunchtime 

Group  Involved:  Six  young 
Muslim  men  who  had  resided 
in  the  U.K.  for  many  years 
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Little  is  known  about  the  third  plotter,  Ramzi  Mohammed.  He  was  23  and  lived  in  west 
London.224  In  his  suicide  note,  found  at  another  plotter’s  apartment,  he  addresses  a  wife  and  two 
sons;  the  note  emphasizes  his  religious  beliefs  and  perceived  spiritual  rewards  for  martyrdom.225 
He  was  also  a  Somali  who  came  to  the  U.K.  in  the  1990s.226 

The  fourth  suspect  claimed  to  be  a  Somali  refugee  named  Osman  Hussain,  and  most  reports  use 
this  name  for  him.  However,  it  has  since  emerged  that  he  is  in  fact  an  Ethiopian  named  Hamdi 
Adus  Isaac;  he  had  lived  under  his  true  identity  in  Italy,  from  1991  until  he  came  to  the  U.K.  in 
1996. 227  He  changed  his  name  when  he  entered  the  U.K.  and  claimed  Somali  nationality  because 
he  believed  this  would  better  enable  him  to  achieve  refugee  status.228  Other  reports  indicate  that 
he  was  part  of  a  group  of  radicals  who  attempted  to  take  control  of  the  mosque  in  Stockwell, 
where  he  resided,  following  the  closure  of  the  extremist-oriented  Finsbury  Park  Mosque.229  He 
had  a  wife  and  three  children.210 

Little  information  is  known  regarding  Manfo  Asiedu,  the  fifth  suspect,  other  than  his  age  at  the 
time  of  the  attacks:  33.  His  country  of  birth  is  unknown,  although  he  arrived  in  the  U.K.  bearing  a 
Ghanaian  passport  in  the  name  of  George  Nanak  Marquaye.  Authorities  believe  his  true  name 
may  be  Sumaila  Abubakari.211 

Adel  Yahya,  the  sixth  suspect,  is  believed  to  have  been  part  of  a  support  cell  and  did  not  deploy 
with  the  others  to  execute  the  plot.  He  was  born  in  Ethiopia  in  September  1979  and  may  have 
lived  in  Y emen  at  one  point. 212  He  is  known  to  have  attended  London  Metropolitan  University, 
where  he  studied  computer  technology.211 


Motivation 

The  men  responsible  for  the  July  7  bombings,  generally  speaking,  were  able  to  keep  their 
extremist  ideology  hidden  from  family  and  acquaintances.  However,  those  behind  the  July  21  plot 
were  known  by  neighbors  and  acquaintances  to  harbor  radical  agendas.  Ibrahim  and  Omar 
frequented  the  Finsbury  Park  mosque214 — known  as  a  focal  point  for  violent  jihadism — prior  to 
its  closure.215  Ibrahim  also  traveled  to  Sudan  in  2003  for  “jihadi  training”  and  made  a  similar  trip 
to  Pakistan  in  December  2004.216  Material  found  at  their  apartments — including  extremist  Islamic 
literature,  videos  of  beheadings,  and  material  glorifying  the  9/11  attacks — also  indicates  that  the 
plotters  were  driven  by  a  deep-seated  dedication  to  violent  jihad. 

Planning 

Planning  for  this  operation  began  no  later  than  April  2005,  when  Asiedu,  Yahya,  and  Ibrahim  are 
known  to  have  made  purchases  for  the  bomb  components.217  There  is  no  specific  information 
regarding  rehearsals  or  dry  runs;  however,  the  fact  that  the  attackers  were  able  to  deploy  with  the 
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bombs  undetected  and  to  attempt  to  detonate  their  weapons  near  simultaneously  suggests  that 
some  sort  of  dry  run  may  have  occurred. 

The  failure  of  the  weapons  from  a  flaw  in 
manufacturing  suggests  that  no  test  firing 
was  conducted.  Had  such  a  test  occurred, 
the  terrorists  may  have  realized  there  was  a 
problem  with  their  mixture  and  not 
attempted  the  attack  until  it  was  corrected. 

It  is  difficult  to  determine  if  these  plotters 
incorporated  any  lessons  from  the  attacks 
two  weeks  earlier.  While  the  targets  and 
tactics  were  very  similar,  this  does  not 
necessarily  mean  that  the  latter  plot  was 
inspired  by  the  former.  At  a  minimum, 
however,  the  earlier  attack  proved  the 
viability  of  the  concept  and  in  that  regard 
could  have  confirmed  in  the  minds  of  the 
July  2 1  bombers  that  their  plan  was  sound. 

Attack 

The  Weapon 

There  is  detailed  information  regarding  the 
weapons,  because  all  five  were  recovered 
either  intact  or  nearly  intact. 

The  main  charge  was  a  mixture  of 
hydrogen  peroxide  and  chapatti  flour  (used 
for  a  bread  popular  in  South  Asia)  in  a  ratio 
of  70  to  30.  The  flour  provided  the  fuel  for 
the  explosion  while  the  hydrogen  peroxide 
acted  as  the  oxidant.  The  charge  was  to  be 
placed  in  a  6.25-liter  plastic  container  with  a  lid.  A  hole  was  made  in  the  bottom  of  each 
container,  through  which  a  homemade  detonator  was  inserted.  The  detonator  contained  triacetone 
triperoxide  (TATP),  made  by  mixing  hydrogen  peroxide,  acetone,  and  hydrochloric  acid — all 
easily  obtainable.  The  TATP  was  contained  inside  a  tube,  at  the  bottom  of  which  was  mounted  a 
small  bulb.  The  bulb  contained  more  TATP  and  was  connected  to  two  wires.239 

The  devices  were  hidden  inside  backpacks,  and  the  wires  were  fed  through  slits  in  the  back  of  the 
packs  and  concealed  inside  the  bombers’  clothing.  The  bombers  were  to  connect  the  wires  to  a  9- 
volt  battery  they  were  carrying;  this  would  complete  the  circuit,  sending  a  charge  to  the  bulb.  The 
TATP  inside  the  bulb  would  detonate,  setting  off  the  remainder  of  the  TATP  in  the  detonator  tube 
and  consequently  the  main  charge.  To  maximize  lethality,  the  bombs  were  covered  with  screws, 
nuts,  tacks,  and  other  hardware  that  would  act  as  shrapnel.240 


The  London  Attacks: 

Copycat,  Independent,  or  Related? 

The  similarity  of  the  attacks  on  July  7  and  July  21, 
2005,  raises  the  question  of  how — or  whether — the 
attacks  were  related.  There  are  three  possibilities:  that 
the  latter  plot  was  a  copycat  attack  conducted  by  a 
group  inspired  by  the  former’s  success;  that  the  two 
attacks  were  totally  independent  and  any  similarities 
were  a  coincidence;  or  that  they  were  related  plots,  part 
of  a  larger  campaign. 

It  is  unlikely  that  the  latter  attempt  was  a  hastily 
planned  copycat  effort.  This  theory  is  refuted  by 
evidence,  presented  at  trial,  that  the  July  21 
conspirators  began  acquiring  materials  for  their  bombs 
in  April  2005,  nearly  three  months  prior  to  the  July  7 
attack.  If  the  accused  terrorists  are  to  be  believed,  they 
conceived  of  the  attack  in  September  2004,  out  of 
frustration  with  the  ineffectiveness  of  peaceful  protests 
against  the  Iraq  War. 

It  is  less  clear  whether  the  attacks  were  independent  or 
related.  However,  it  is  difficult  to  imagine  that  two 
completely  independent  plans  would  both  target  three 
Underground  trains  and  a  bus,  using  suicide  tactics, 
and  employing  peroxide-based  backpack  bombs.  There 
is  other  circumstantial  evidence  that  may  point  to  some 
sort  of  tie:  the  fact  that  members  of  both  cells  may 
have  attended  the  same  whitewater  camp  and  the 
contemporaneous  presence  of  Khan  and  Tanweer  (July 
7  plotters)  and  Ibrahim  (July  21  plotter)  in  Pakistan  in 
late  2004.  Based  on  this  circumstantial  evidence,  and 
the  unlikelihood  of  the  similarities  being  coincidental, 
the  most  plausible  explanation  is  that  the  two  plots 

were  somehow  related,  perhaps  as  autonomous  attacks 
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directed  from  a  central  command  authority.” 
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Deployment 

While  the  July  7  attacks  occurred  during  the  morning  rush  hour,  this  attack  was  to  commence 
during  the  lunch  hour.  Just  before  noon  on  July  21,  the  bombers  deployed  for  their  attacks  from 
two  locations. 

Y assin  Omar,  Muktar  Ibrahim,  and  Ramzi  Mohammed  all  started  at  the  Stockwell  station  in  the 
south-central  portion  of  the  Underground.  Omar  headed  due  north  on  the  Victoria  Line,  with  his 
target  the  Warren  Street  Station  (not  far  from  King’s  Cross,  Tavistock  Square,  and  Russell 
Square,  which  all  figured  prominently  in  the  July  7  attacks).  Ibrahim  took  the  Northern  Line, 
going  as  far  as  the  Bank  Station  before  leaving  the  Underground  and  transferring  to  the  Number 
26  bus,  which  heads  due  east.  Mohammed’s  target  was  the  next  stop  up  on  the  Northern  Line,  the 
Oval  Station  in  the  southern  portion  of  the  Underground.  He  let  the  others  go  ahead  of  him  so 
they  could  all  be  in  location  for  near  simultaneous  attacks.241 

Meanwhile  Osman  Hussain  (also  known  as  Hamdi  Isaac)  and  Manfo  Asiedu  began  their 
deployment  from  Westboume  Park  Station.  At  noon,  Hussain  received  a  call  from  Ramzi 
Mohammad  at  Stockwell  Station,  most  likely  to  initiate  the  deployment.  He  then  boarded  a  train 
on  the  Hammersmith  and  City  Line,  headed  for  his  target  at  the  Shepherd’s  Bush  Station,  in  the 
western  portion  of  the  system.  Asiedu,  however,  apparently  decided  against  carrying  out  his 
attack.  Instead,  he  left  the  Underground  and  headed  to  a  nearby  park  called  Little  Wormwood 
Scrubs  and  abandoned  his  weapon.242 

Execution 

Hussain  was  the  first  to  attempt  to  detonate  his  device.  At  approximately  12:25  PM,  approaching 
Shepherd’s  Bush,  he  attached  the  wires  to  the  9-volt  battery,  setting  off  the  detonator;  however, 
the  main  charge  failed.  The  explosion,  though  not  large  enough  to  cause  any  damage  or 
casualties,  caused  significant  panic  on  board  the  train.  When  it  reached  the  platform,  he  lowered 
himself  through  a  window  and  down  a  wall,  disappearing  into  a  nearby  neighborhood.241 

Mohammad  attempted  to  set  off  his  device  five  minutes  later,  with  identical  results.  He  also  fled 
the  train,  and  three  passengers  unsuccessfully  attempted  to  catch  him.244 

Fifteen  minutes  later,  Omar  initiated  his  attack,  and  once  again,  only  the  detonator  functioned.  As 
with  the  others,  he  fled  the  scene  amid  the  panic  caused  by  the  sound  of  the  detonator 
exploding.245 

Ibrahim  attempted  to  detonate  his  device  on  board  the  Number  26  bus  just  after  1 :00  PM.  Like  the 
bus  bomber  on  July  7,  he  positioned  himself  on  the  upper  deck;  however,  there  were  few 
passengers  on  that  level  and  only  12  total  on  the  bus.  Again,  the  main  charge  failed  to  detonate 
and  Ibrahim  was  forced  to  flee.246 

Police  bomb  experts  were  later  able  to  conclude  why  the  bombs  failed.  Hydrogen  peroxide  is 
available  commercially  only  in  diluted  form  (18%  concentration  at  most).  Therefore,  the  bombers 
needed  to  purchase  large  quantities  of  the  chemical  and  boil  it  down  in  order  to  achieve  the 
required  concentration.247  Forensic  analysis  of  the  remains  of  the  bombs  indicated  that  the 
concentration  was  too  low.248 
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Consequences 

Consequences  of  the  attempts  were  negligible.  Because  the  devices  did  not  function  as  designed, 
there  were  no  casualties  inflicted;  the  only  material  damage  was  to  the  Number  26  bus,  which  had 
several  windows  blown  out  by  the  force  of  the  detonator’s  explosion.249  There  was  very  little 
disruption  of  the  London  transit  system.  Three  stations  were  evacuated  (Shepherd's  Bush,  Oval, 
and  Warren),  and  the  area  around  the  Number  26  Bus  was  cordoned  off;250  the  entire  system  was 
shut  down  temporarily  but  was  reopened  in  time  for  the  evening  rush  hour.251  Media  coverage 
was  extensive  and  worldwide  and  continued  for  weeks;  with  the  commencement  of  the  trial  in 
January  2007,  there  was  another  surge  of  media  coverage.  News  reports  and  commentary  called 
attention  to  the  similarity  to  the  July  7  bombings  and  alleged  implications  for  wider  conspiracy. 
This  plot  did  not  focus  on  a  symbolic  target,  and  no  operational-level  network  was  penetrated  or 
compromised. 

Surveys  and  economic  data  tend  to  aggregate  the  effects  of  both  July  bomb  attacks.  One  could 
consider  the  July  2 1  attacks  a  second  and  amplifying  event  that  exacerbated  the  psychological 
impact  of  the  July  7  attack;  in  that  case,  one  could  view  the  British  Medical  Journal  survey 
results  described  on  page  38  as  descriptive  of  the  impact  of  this  attack  as  well.  Likewise,  the 
moderate  economic  impact  described  in  the  London  Chamber  of  Commerce  survey  (page  38) 
should  be  considered  a  reflection  of  the  July  21  attacks  as  well  as  the  previous  incident.  The  same 
is  true  of  resulting  counterterrorism  legislation  and  the  adverse  impact  on  the  attitudes  of  British 
Muslims.  At  the  same  time,  the  terrorists  achieved  some  psychological  advantage  in 
demonstrating  that  they  could  strike  at  the  same  target  twice  in  a  matter  of  two  weeks,  despite 
heightened  security. 

Factors  Associated  With  Success  or  Failure 

A  number  of  a  factors  are  associated  with  this  attempted  attack: 

Training :  The  terrorists  exhibited  a  high  degree  of  training  and  discipline  in  certain  areas:  they 
were  able  to  maintain  operational  security,  they  acquired  the  necessary  components  for  the 
weapons,  and  they  were  able  to  deploy  to  their  targets  and  initiate  the  execution  phase  nearly 
simultaneously.  However,  their  training  was  insufficient  regarding  the  proper  method  for  creating 
the  main  charge  of  their  weapons,  resulting  in  net  failure. 

Technical  sophistication:  The  terrorists  did  not  possess  the  technical  sophistication  required  to 
fabricate  the  hydrogen  peroxide  and  chapatti  flour  explosives.  While  the  fact  that  the  detonators 
functioned  as  designed  shows  a  certain  degree  of  proficiency,  ultimately  the  plot  failed  because  of 
mistakes  in  achieving  the  correct  concentration  of  hydrogen  peroxide. 

Operational  proficiency:  The  attackers  were  proficient  in  deploying  to  their  intended  targets  and 
initiating  their  attacks.  The  failure  of  the  charges  was  not  due  to  a  lack  of  operational  proficiency, 
but  rather  to  their  lack  of  sophistication  in  preparing  the  main  charge. 

Terrorist  profile  indicators'.  Those  involved  in  this  plot  were  known  by  acquaintances  to  hold 
extremist  views,  and  one  (Ibrahim)  had  a  violent  criminal  record. 

Terrorist  OPSEC :  Terrorist  OPSEC  was  good.  The  men  maintained  a  small  organization,  did  not 
involve  unnecessary  or  unvetted  support  personnel,  and  were  able  to  deploy  and  initiate  the 
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execution  phase  unhindered.  They  had  one  unreliable  member  who  contributed  to  the  failure  of 
the  operation. 

Innovation :  The  attack  was  not  innovative;  it  was  nearly  identical  to  the  plot  executed  two  weeks 
earlier.  From  the  perspective  of  those  planning  this  plot,  there  would  be  advantages  and 
disadvantages  to  using  an  identical  attack  plan.  Since  the  July  7  attack  had  been  successful  in 
many  regards,  it  verified  the  validity  of  attacking  in  this  way.  On  the  other  hand,  the  plotters 
might  have  anticipated  that  both  the  authorities  and  the  public  at  large  would  be  sensitive  to 
indications  of  a  similar  attack  in  the  immediate  aftermath  of  the  first  series  of  bombings.  They 
discounted  that  as  a  reason  to  change  process. 

Technical  difficulties :  The  bombers  experienced  a  significant  technical  difficulty  when  the  main 
charge  of  the  bombs  failed  to  detonate.  A  simpler  device  might  have  been  within  their  level  of 
technical  competence — for  example,  they  could  have  used  TATP,  which  they  mixed  correctly  for 
the  detonators,  as  the  main  charge. 

Law  enforcement  or  intelligence  knowledge :  Law  enforcement  and  security  officials  had  no 
knowledge  of  the  plan  until  it  was  executed. 

Security  environment.  As  was  the  case  with  the  July  7  plot,  the  security  environment  in  the 
United  Kingdom  at  the  time  could  be  characterized  as  restrictive  regarding  anti-terror  laws 
enacted  since  the  IRA  bombing  campaigns,  while  permissive  in  terms  of  the  latitude  given  to 
radical  clerics  to  inspire  British  Muslims  to  acts  of  violence. 

Effective  information  sharing :  There  is  no  indication  of  any  information  exchanged  among 
security  authorities  relating  to  this  event.  However,  it  should  be  noted  that  little  information  had 
been  developed  regarding  this  plot  or  the  actors  involved. 

International  cooperation :  There  is  evidence  of  some  international  cooperation  prior  to  the  event, 
but  no  information  was  developed  that  could  have  thwarted  the  attempt.  After  the  attempt,  Osman 
Hussain  fled  to  Italy,  where  his  brother  lived.  Cooperation  between  British  and  Italian  authorities 
resulted  in  Hussain’s  capture  and  eventual  extradition  to  the  U.K.  for  trial.252 

Observant  public  and/or  vigilant  security  services :  While  there  are  no  survey  data  from  that 
period  to  depict  a  level  of  increased  awareness,  one  could  logically  surmise  that  Londoners  using 
rail  or  bus  transportation  were  more  perceptive  of  suspicious  behavior  on  the  transit  system  or  in 
their  neighborhoods,  given  the  events  of  July  7.  However,  this  did  not  result  in  any  alarms  being 
raised  before  the  execution  phase  was  initiated. 

Findings 

The  failure  of  this  plot  may  be  attributed  to  a  single  factor — the  terrorists  attempted  to  create  a 
weapon  beyond  their  technical  capability.  Had  they  succeeded  in  concentrating  the  hydrogen 
peroxide  to  a  sufficient  level,  the  weapons  would  have  functioned  as  designed  and  likely  caused 
results  similar  to  the  July  7  attacks.  Since  the  failure  of  the  weapons  to  function  cannot  be 
attributed  to  any  act  on  the  part  of  security  services,  there  is  no  executable  lesson  to  be  gleaned — 
other  than  the  necessity  of  interdicting  terrorist  operations  prior  to  the  deployment  stage  and  to 
exploit  any  gaps  in  operational  security  presented  by  terrorist  cells. 
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Section  III — Commercial  Aviation 


Specific  Vulnerabilities  of  Commercial 
Aviation 

Before  examining  specific  case  studies,  it  is  useful  to  identify  aspects  of  commercial  aviation  that 
affect — negatively  or  positively — the  ability  of  terrorists  to  attack  this  sector  successfully. 

Various  Means  of  Attacking  Aircraft 

Compared  to  other  categories  of  targets,  there  are  many  more  attack  paths  that  can  lead  to  the 
destruction  of  an  airliner  or  its  possible  use  as  a  weapon.  This  complicates  security  efforts  by 
creating  more  requirements  to  counter  the  multiple  threats  and  creates  a  vulnerability  that  can  be 
exploited  by  innovative  terrorist  planning. 

One  method  of  attack  is  to  introduce  an  explosive  into  the  cargo  hold  of  an  airliner,  either  in 
checked  baggage  or  as  air  freight.  One  well-known  example  of  this  method  is  the  bombing  of  Pan 
Am  Flight  103.  Libyan  intelligence  agents  placed  a  bomb  (  consisting  of  plastic  explosives  hidden 
in  a  portable  radio)  inside  luggage  on  a  flight  from  Malta  to  Frankfurt,  Germany;  it  was  tagged 
for  transfer  to  London’s  Heathrow  Airport  and  then  put  on  Pan  Am  103  to  John  F.  Kennedy 
Airport  in  New  York.  The  device  was  detonated  by  an  electronic  timer,  and  the  aircraft  was 
destroyed  over  Lockerbie,  Scotland.  All  259  passengers  and  crew  were  killed,  as  well  as  1 1 
people  on  the  ground.251 

Besides  checked  baggage,  airliners  fly  with  freight  in  their  cargo  holds  that  is  not  subject  to  the 
same  scrutiny  as  personal  baggage.  In  fact,  companies  can  apply  to  be  designated  as  “known 
shippers;”  after  undergoing  a  security  vetting  process,  cargo  sent  by  known  shippers  is  not 
inspected  unless  a  parcel  appears  suspicious.254  While  this  program  balances  security  against  the 
needs  of  commerce,  it  still  presents  gaps  that  may  be  exploited.  As  one  industry  source  put  it, 

“There  are  approx  1.5  million  known  shippers  in  the  U.S.  There  are  thousands  of 
freight  forwarders.  Anywhere  down  the  line  packages  can  be  intercepted  at  these 
organizations.  Even  reliable  respectable  organizations,  you  really  don't  know 
who  is  in  the  warehouse,  who  is  tampering  with  packages,  putting  parcels 
together.”255 

Another  way  of  introducing  an  explosive  onboard  an  aircraft  in  flight  is  to  place  it  in  the  cabin, 
either  to  be  detonated  by  timer  or  by  suicide  bomber.  This  method  offers  the  advantage  of 
positive  control  regarding  the  placement  of  the  device  and,  in  the  case  of  suicide  bombings,  its 
detonation.  However,  since  all  passengers  must  pass  through  individual  screening,  it  is  more 
difficult  to  bring  a  device  on  board  in  this  way.  Three  of  our  case  studies  demonstrate  innovative 
methods  used  by  terrorists  to  circumvent  screening  and  place  explosives  inside  the  cabin  of  the 
aircraft.  In  both  the  Bojinka  plot  and  the  plan  to  destroy  U.S.  airliner  flying  from  the  U.K.,  the 
components  of  the  bombs  were  disguised  and  hidden  in  items  commonly  found  in  carry-on 
baggage.  Further,  the  terrorists  planned  to  use  liquid  explosives,  which  would  not  have  been  easy 
to  detect  by  the  safeguards  in  place  at  that  time.  The  hijackers  of  Air  France  8969  took  a  different 
approach:  they  disguised  themselves,  rather  than  the  weapon,  to  place  explosives  in  the  cabin. 
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They  were  able  to  gain  free  access  to  the  aircraft,  and  once  they  had  taken  control,  they  were  able 
to  position  the  explosives. 

Whether  in  the  cargo  hold  or  the  cabin,  the  amount  of  explosive  required  to  destroy  an  aircraft  is 
considerably  less  than  that  needed  to  inflict  casualties  on  a  train  or  to  destroy  a  building.  Because 
of  this,  it  is  easier  to  covertly  introduce  a  weapon  to  an  aircraft  than  other  classes  of  targets.  For 
example,  the  small  amount  of  explosive  planned  for  the  Bojinka  plot  could  be  hidden  in  a  contact 
lens  solution  bottle.  Sports  drink  bottles  were  to  be  used  in  the  2006  airline  plot  in  the  United 
Kingdom. 

Chemical  and  Biological  Attack 

Explosives  are  not  the  only  means  to  cause  casualties  on  a  commercial  aircraft.  Because  of  the 
closed  conditions  in  the  cabin,  a  chemical  or  biological  weapon  could  be  released  with  no 
possibility  for  the  passengers  and  crew  to  escape  the  lethal  agent.  Flowever,  there  are  difficulties 
with  weaponizing  agents  and  other  issues  which  would  make  an  attack  difficult  to  execute.  While 
there  have  been  no  known  cases  in  which  such  an  attack  was  planned,  this  is  nevertheless  a 
vulnerability  that  could  be  exploited  in  the  future. 

Insider  Threat 

Insiders — including  the  air  crew  itself — could  cause  the  destruction  of  the  aircraft  as  well. 
Although  there  has  never  been  a  known  case  of  a  crew  member  participating  in  a  terrorist  plot, 
one  event  in  particular  underscores  this  vulnerability.  In  October  1999,  Egypt  Air  Flight  990 
crashed  into  the  Atlantic  Ocean  killing  all  aboard.  The  National  Transportation  Safety  Board 
concluded  that  “the  probable  cause  of  the  Egypt  Air  Flight  990  accident  is  the  airplane’s 
departure  from  normal  cruise  flight  and  subsequent  impact  with  the  Atlantic  Ocean  as  a  result  of 
the  relief  first  officer’s  flight  control  inputs.  The  reason  for  the  relief  first  officer’s  actions  was 
not  determined.”256  Although  suspicions  that  the  relief  first  officer,  Gamil  al-Batouti,  destroyed 
the  aircraft  as  part  of  a  terrorist  plot  were  eventually  dismissed  by  both  U.S.  and  Egyptian 
investigators,  this  event  highlights  the  vulnerability  of  an  airliner  to  destruction  by  a  flight  crew 
member  whose  intentions  are  not  detected. 

The  attacks  on  September  1 1 ,  200 1 ,  were  an  innovative  variation  on  this  event;  in  fact,  CIA 
director  George  Tenet  later  stated  he  believed  that  the  Egypt  Air  990  attack  convinced  Osama  bin 
Laden  that  the  U.S.  airline  system  was  vulnerable  to  a  catastrophic  attack.257  In  addition,  there  is 
evidence  that  al  Qaeda  had  considered  a  crew  member  suicide  attack  in  late  1994:  while  the 
Bojinka  plot  centered  on  the  midair  destruction  of  airliners  over  the  Pacific  Ocean,  there  was  also 
discussion  of  crashing  an  airliner  into  the  headquarters  of  the  Central  Intelligence  Agency  in 
Langley,  VA.258  The  plot  was  uncovered  prior  to  its  execution,  so  it  is  not  known  whether  this 
aspect  of  the  operation  was  seriously  considered. 

Besides  flight  and  cabin  crew,  others  have  frequent  access  to  airliners  on  the  ground.  This  would 
include  maintenance  personnel,  who  could  sabotage  critical  components  of  the  aircraft,  or  service 
crews  who  clean  the  aircraft  or  load  in-flight  meals.  While  such  personnel  are  vetted  to  a  degree, 
they  are  not  subject  to  the  same  scrutiny  as  a  passenger.  Illustrating  this  vulnerability,  29  cargo 
handlers  at  Miami  International  Airport  were  arrested  in  April  2007;  they  had  been  using  their 
access  to  facilitate  the  smuggling  of  cocaine  and  heroine  on  international  flights.  259A  co-opted 
ground  crew  member  could  place  a  device  on  board  the  aircraft  or  pre-position  weapons  or  bomb 
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components  for  others.  No  such  action  has  been  detected  in  the  past,  although  Amin  Asmin  Tariq, 
arrested  in  connection  with  the  liquid  explosives  plot  in  August  2006,  was  employed  as  a  security 
guard  at  Heathrow  Airport  and  would  have  had  special  access  to  secure  areas.260 

Standoff  Attack 

Further  complicating  security  measures,  aircraft  can  be  destroyed  by  standoff  threats  as  well.  For 
example,  airliners  could  be  attacked  with  man-portable  air  defense  systems  (MANPADS),  which 
fire  small  surface-to-air  missiles.  Many  of  these  systems  are  simple  to  use,  readily  available  on 
the  black  market  and  relatively  inexpensive.  Insurgent  forces  in  Iraq  and  Afghanistan  have  used 
MANPADS  and  are  knowledgeable  in  their  use,  and  they  could  train  potential  terrorists  for  their 
deployment  in  Western  countries.  Such  a  missile,  homing  on  the  infrared  signature  of  the 
aircraft’s  engines,  could  possibly  cause  catastrophic  failure  during  takeoff  or  landing.  It  should  be 
noted,  though,  that  according  to  the  Congressional  Research  Service  there  have  been  only  six 
attacks  on  large  turbojet  airliners  with  MANPADS  since  1980,  and  only  two  of  these  resulted  in 
loss  of  the  aircraft.261  Less-sophisticated  means,  including  high-caliber  rifles  and  rocket-propelled 
grenades,  could  also  be  used  against  aircraft.  Although  none  of  the  case  studies  involved  a 
standoff  attack,  terrorists  may  turn  to  this  method  as  security  measures  make  other  means 
increasingly  difficult  to  execute. 

Summary 

Taken  together,  these  possibilities  create  challenges  for  the  aviation  security  community  and 
opportunities  for  terrorists.  Our  case  studies  demonstrate  a  constant  theme:  terrorists  are  aware  of 
the  vulnerabilities  of  commercial  aviation  and  attempt  to  find  innovative  methods  to  overcome 
security  measures  and  execute  their  attacks.  Because  it  is  difficult  to  create  countermeasures 
against  the  wide  variety  of  innovative  and  unexpected  methods  of  attack,  it  is  important  that 
terrorist  plots  be  detected  and  interrupted  before  they  reach  the  execution  stage.  Security  services 
must  do  more  than  react  to  the  most  recent  plot — they  must  recognize  vulnerabilities  and 
weaknesses,  realize  that  terrorists  are  aware  of  these  as  well,  and  act  to  prevent  exploitation  of  the 
vulnerabilities  in  future  attacks. 

The  tables  on  the  following  pages  deconstruct  the  four  cases  and  display  the  results  for  purposes 
of  comparison. 
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Table  3-1:  Commercial  Aviation  Sector — Indicators  of  Success 
Tactical  Level  Indicators  of  Success 


Case  Study 

Was  the  attackers’  security  plan 
maintained  pre-execution? 

Was  the  attack 
initiated? 

Did  the  weapon(s)  function 
as  designed? 

What  was  the  level  of 
lethality? 

What  was  the  level  of 
injuries  sustained? 

What  was  the  level  of 
material  damage? 

Did  the  cell  members 
avoid  capture/ 
death? 

Air  France  Hijacking 

Yes 

Partially 

N/A 

Low 

None 

None 

No 

Operation  Bojinka 

No 

No 

Some  (Dry  Run) 

Low  (Dry  Run) 

Low  (Dry  Run) 

Minor  (Dry  Run) 

No 

9/11 

Yes 

Yes 

Yes 

High 

High 

High 

Moderate 

Liquid  Explosives  Plot 

No 

No 

N/A 

N/A 

N/A 

N/A 

No 

Operational  Level  Indicators  of  Success 


Case  Study 

Was  the  broader  network  security 
maintained? 

What  was  the  level  of  system 
disruption? 

What  was  the  level  of  media 
coverage? 

Did  the  plot’s  target  have 
symbolic  value? 

Did  the  network  members  avoid 
capture/death? 

Air  France  Hijacking 

Yes 

None 

Moderate 

Moderate 

Yes 

Operation  Bojinka 

No 

None 

Moderate 

No 

No 

9/11 

Yes 

Severe 

High 

Yes 

Moderate 

Liquid  Explosives  Plot 

No 

Minor 

High 

No 

No 

Strategic  Level  Indicators  of  Success 


Case  Study 

What  was  the  level  of  psychological  impact? 

What  was  the  level  of  economic  impact? 

What  was  the  level  of  policy  change? 

What  was  the  level  of  impact  on  the  supporting 
population? 

Air  France  Hijacking 

Low 

Low 

Moderate 

N/A 

Operation  Bojinka 

None 

None 

None 

N/A 

9/11 

High 

High 

High 

High 

Liquid  Explosives  Plot 

Moderate 

Moderate 

Moderate 

N/A 
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Table  3-2:  Commercial  Aviation  Sector — Factors 
Commercial  Aviation  Success  Factors — Adversary-Related 


Case  Study 

Factors 

What  was  the  level  of  the 
terrorists’  training? 

What  was  the  level  of  the  terrorists’ 
technical  sophistication? 

What  was  the  level  of  the 
terrorists’  operational 
proficiency? 

Were  there  terrorist 
profile  indicators? 

What  was  the  level  of 
terrorist  OPSEC? 

What  was  the  level  of 
innovation? 

Did  the  terrorists  experience 
any  technical  difficulties? 

Air  France 
Hijacking 

Moderate 

Low 

Low 

High 

Low 

Moderate 

Moderate 

Operation 

Bojinka 

High 

Moderate 

High 

High 

Low 

High 

High 

9/11 

High 

Low 

High 

Moderate 

High 

High 

Low 

Liquid 

Explosives  Plot 

Moderate 

Unknown 

Unknown 

Low 

Low 

Moderate 

Unknown 

Commercial  Aviation  Success  Factors  -  Security-Related 


Case  Study 

Factors 

Was  access  to  the 
target  site  restricted? 

What  was  the  level  of  law 
enforcement  knowledge  of  the 
plot? 

Was  the  security  environment 
restrictive? 

What  was  the  level  of 
information  sharing? 

What  was  the  level  of 
international  cooperation? 

What  was  the  level  of  vigilance 
of  the  public  and  security 
services? 

Air  France  Hijacking 

Moderate  restriction 

None 

Moderately  restrictive 

Low 

Low 

Low 

Operation  Bojinka 

Moderate  restriction 

High 

Not  restrictive 

High 

High 

High 

9/11 

Moderate  restriction 

Low 

Moderately  restrictive 

Very  Low 

Low 

Low 

Liquid  Explosives  Plot 

Moderate  restriction 

High 

Moderately  restrictive 

High 

High 

High 

Table  3-3:  Commercial  Aviation  Sector — Case  Study  Descriptions 


PLANNING 

EXECUTION 

Target  Selection 
(Note:  Target,  Method  and 
Personnel  Selection  can  occur 
in  any  order) 

Method  Selection 

Personnel  Selection 

Intelligence  Gathering  & 
Surveillance 

Logistics,  Resources, 
Materiel,  Support  Network 

Training  (Including 
Rehearsals  &  Dry  Runs) 

Weapon  Assembly 

Stage  for  Attack 

Execute 

Air  France 

8969 

December 

1994 

Eiffel  Tower  or  Paris  at  large 
(unknown  if  this  was  the  original 
intent  or  selected  after  hijacking) 
Moderate  security  barriers  in 
place 

Hijacked  airliner  as  weapon 
Innovative 

Most  likely  selected  by  senior 
leaders  in  GIA 

Unknown,  but  likely  (attackers 
had  knowledge  of 
uniforms/credentials  to  use  to 
circumvent  security) 

Unknown,  but  acquisition  of 
uniforms/credentials  suggests 
strong  support  network 

Unknown 

Dynamite  set  for 
detonation  during 
hijacking 

Hijackers  bypassed 
security  and 
boarded  aircraft 
successfully 

Hijacking  executed 
successfully;  CT  forces 
interdicted  before  Paris 
attack  could  be  executed 

Operation 

Bojinka 

December 

1994-January 

1995 

11-12  US  trans-Pacific  airliners; 
CIA  HQ  Significant  security 
barriers  in  place 

Time-detonated  liquid 
explosives  in  cabin  of 
airliners;  crash  airliner  into 

CIA  HQ  Innovative 

Selected  by  KSM  and/or 

Ramzi  Yousef;  operatives 
were  experienced  terrorists 

Detailed  flight  information 
gathered  by  Yousef 

Funds  from  unknown  source 
funneled  through  support 
network  in  Indonesia 

Bomb  tested  at  Greenbelt 
Theatre;  bomb  and  concept 
of  employment  tested  on 

PAL  flight 

Plot  uncovered  because 
of  fire  resulting  from 
errors  in  mixing 
chemicals,  possibly  for 
final  weapons 

Plot  interdicted  prior 
to  this  stage. 

Plot  interdicted  prior  to 
this  stage. 

WTC/Pentagon 
Sep  11,  2001 

Key  economic/governmental 
facilities  Significant  security 
barriers  in  place 

Aircraft  as  weapons  Unusual, 
but  not  unprecedented 

Formal  selection  by  AQ 
leaders 

Terrorists  likely  gathered 
information  on  security  during  dry 
runs;  also  gathered  flight 
schedule  data  to  select  target 
aircraft 

Support  and  resources 
provided  through  AQ  Central; 
total  cost  ca.  S400-500K 

Pilot  terrorists  conducted 
dry  runs  May-Jul  2001 

None  required 

All  hijackers 
bypassed  security 
and  staged  on 
target  flights 

Attacks  on  WTC  and 
Pentagon  executed  as 
planned;  fourth  aircraft 
destroyed  during  struggle 
prior  to  reaching  target 

Liquid 
Explosives 
August  2006 

U.S.  airliners  departing  from  U.K. 
Significant  security  barriers  in 
place 

Suicide-detonated  liquid 
explosives  on  unknown 
number  of  aircraft  Unusual, 
but  not  unprecedented 

Unknown  -  most  likely  self¬ 
selection  of  radical 
acquaintances 

Unknown 

Most  likely  self-financed 

Unknown,  but  U.K. 
authorities  believe  no  dry 
runs  conducted  prior  to 
arrests 

Weapons  not  assembled 
prior  to  arrests 

Plot  interdicted  prior 
to  this  stage. 

Plot  interdicted  prior  to 
this  stage. 
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The  Hijacking  of  Air  France  Flight 
8969 — December  1994 

Overview 

On  December  24,  1994,  shortly  before  noon,  four  Algerian  terrorists  walked  across  the  tarmac  of 
the  Houari  Boumediene  Airport  in  Algiers262  and  boarded  Air  France  Flight  8969,  which  was 
bound  for  Paris.  The  men  entered  the  A300  Airbus  dressed  in  Air  Algerie  uniforms263  and, 
claiming  to  be  security  agents,  began  to  check  the 
passengers’  passports.264  Soon  thereafter,  one  hijacker 
shouted,  “Allah  is  great”;  three  of  the  terrorists  entered  the 
cockpit,  while  the  fourth  held  the  people  in  the  cabin 
hostage  with  a  Kalashnikov.265  An  Algerian  policeman 
was  identified  and  shot  in  the  head.  Shortly  afterwards  the 
terrorists  killed  a  second  passenger,  a  Vietnamese 
diplomat.266 

The  hijackers  were  members  of  the  Algerian  Islamic  terrorist  organization  Groupe  Islamique 
Anne  (Armed  Islamic  Group)  or  GIA.  Initially,  they  demanded  the  release  of  two  leaders  of  a 
banned  Islamic  organization,  the  Islamic  Salvation  Front.267  A  standoff  ensued,  and  the  terrorists 
eventually  agreed  to  release  women  and  children.  The  hijackers  dropped  the  demand  for  the 
release  of  prisoners  and  instead  insisted  that  they  be  allowed  to  take  off  and  depart  Algeria.  When 
Algerian  security  forces  failed  to  allow  their  departure,  the  hijackers  killed  a  third  passenger — a 
cook  at  the  French  Embassy.  The  French  government  was  at  odds  with  its  Algerian  counterpart; 
the  French  wanted  the  aircraft  to  be  allowed  to  fly  to  France,  while  the  Algerians  insisted  that  it 
stay  in  place.  The  Algerians  allowed  the  aircraft  to  depart  after  the  French  citizen  was  killed.268 
The  hijackers  had  wanted  to  fly  to  Paris  but  were  convinced  by  authorities  that  they  did  not  have 
enough  fuel  and  would  have  to  stop  in  Marseille  to  refuel.269 

In  Marseille,  the  terrorists  demanded  27  tons  of  fuel  to  fly  to  Paris.270  That  was  nearly  three  times 
the  amount  required  for  that  route;271  according  to  one  source,  officials  feared  that  “they  would 
head  for  a  friendly  Islamic  country — perhaps  Iran,  or  Sudan,  or  Yemen.”272  More  ominously, 
released  passengers  informed  French  authorities  that  the  hijackers  intended  to  crash  the  fuel-laden 
aircraft  into  the  Eiffel  Tower  or  explode  it  over  the  city  of  Paris.273 

To  prevent  the  aircraft  from  carrying  out  such  an  attack,  the  French  government  deployed  its 
specialized  counterterrorist  police  unit,  the  Groupe  d’lntervention  de  la  Gendarmerie  Nationale 
(GIGN),  to  the  airport.  The  GIGN  was  able  to  practice  its  rescue  maneuvers  on  an  identical 
Airbus.274  While  the  airliner  was  on  the  tarmac,  the  GIGN  team  boarded  the  airliner  and  freed  all 
173  hostages,  killing  all  four  terrorists.275  Twenty  sticks  of  dynamite  were  found  aboard  the 
aircraft.276 

Significance  of  the  Incident 

This  incident  represents  the  first  known  plan  to  use  a  commercial  aircraft  as  a  weapon;  as  such,  it 
may  have  served  as  a  learning  tool  for  the  September  11,  2001  attacks.  This  case  also  illustrates 
the  use  of  disguises  to  overcome  barriers  to  access,  problems  arising  from  the  lack  of 
international  cooperation,  and  successful  anti-terrorist  techniques. 


Type  of  Attack:  Hijacking  with  intent 
to  detonate  explosives  mid-flight 
above  Paris,  or  crash  the  airliner  into 
the  Eiffel  Tower 
Date:  December  24-25,  1994 
Group:  GIA — Groupe  Islamique 
Arme  (Armed  Islamic  Group) 
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Description  of  the  Group  or  Individuals  Involved 

According  to  passengers  on  the  hijacked  flight,  the  terrorists,  who  all  seemed  to  be  in  their  20s, 
clean  shaven,  and  short  haired,  were  polite  yet  had  a  determined  air  about  them.277  Another 
witness  stated,  .  .they  told  us  that  they  would  give  a  lesson  to  the  French  and  to  the  world,  that 
they  would  show  what  they  were  capable  of.”278 

The  GIA  was  arguably  one  of  the  most  violent  Islamic  fundamentalist  groups.279  It  aimed  to 
replace  the  secular  government  in  Algeria  with  an  Islamic  state  and  targeted  government  workers, 
civilians,  and  foreigners.  In  some  cases,  the  GIA  would  destroy  entire  villages;  according  to  one 
estimate,  over  70,000  civilians  were  killed  from  1993  to  1998.280 

In  the  16  months  prior  to  the  hijacking,  the  GIA  had  killed  80  foreigners,281  including  24  French 
citizens.282  Additionally,  the  GIA  had  entered  the  guarded  residence  of  a  French  diplomat,  killing 
three  French  gendarmes  and  two  other  officials.283  Because  of  this  attack,  France  planned  to  adopt 
new  security  measures  to  protect  French  officials  in  Algiers.284  This  provides  an  interesting 
illustration  of  the  dynamic  between  terrorist  learning  and  security  service  learning.  First,  the 
terrorists  conducted  a  successful  attack.  The  French  responded  by  increasing  protection  of  their 
government  workers  in  Algeria;  and  in  response  to  that,  the  GIA  changed  tactics  to  targeting  a 
civilian  airliner  and  possibly  the  French  capital  itself. 

According  to  the  State  Department,  the  GIA’s  goal  was  to  overthrow  the  government  in  Algeria 
and  create  a  fundamentalist  Islamic  state.285  The  GIA  supported  the  Islamic  Salvation  Front  and 
began  its  violent  activity  in  1992  to  protest  the  cancellation  of  elections  in  which  the  victory  of 
the  Islamic  Salvation  Front  was  predicted.286  The  GIA  attacks  ranged  from  attacks  against 
government  workers  to  massacres  of  civilian  Algerians  as  well  as  expatriates  from  Europe.287 

One  of  the  hijackers  identified  by  police  was  Abdul  Abdullah  Yahia,  a.k.a.  “the  Emir.”  He  was 
described  as  a  petty  thief  and  member  of  the  GIA.  He  had  allegedly  taken  part  in  earlier  attacks 
and  was  considered  extremely  devout,  as  were  the  others  involved  in  the  hijacking.  Yahia 
was  described  by  one  source  as  having  taken  part  in  previous  “attacks  of  rare  violence  and 
savagery.”290 

Motivation 

As  members  of  GIA,  the  overarching  motivation  for  the  terrorists  was  the  destabilization  of  the 
secular  government  in  Algiers  and  its  replacement  with  an  Islamic  state.291  In  furtherance  of  that 
goal,  one  source  stated  that  the  terrorists  were  “trying  to  rid  Muslim  Algeria  of  Western 
influence,  specifically  from  France.”292 

As  one  report  put  it,  the  attack  achieved  two  goals:  “to  embarrass  the  embattled  Algerian 
government  and  to  remind  France  of  the  perils  of  involving  itself  in  the  Algerian  civil  war.”293 
Another  source  noted  that  the  group  released  a  statement  claiming  that  the  hijacking  was 
conducted  in  order  to  force  France  to  end  its  “unconditional  political,  military  and  economic  aid” 
to  the  Algerian  government.294  France  had  further  drawn  the  ire  of  the  GIA  by  clamping  down  on 
extremists  in  the  large  Algerian  community  residing  in  the  former  colonial  power.295 
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Planning 

Very  little  is  known  of  the  planning  behind  this  attack.  However,  certain  conclusions  can  be 
drawn  from  the  events  that  transpired. 

First,  the  use  of  Air  Algerie  uniforms  and  identification — whether  authentic  or  counterfeit — 
suggests  a  high  degree  of  planning,  sufficient  resources,  and  perhaps  insider  access,  one  of  the 
specific  vulnerabilities  of  commercial  aviation  which  can  be  exploited  by  terrorists. 

Second,  the  generally  flawless  execution  of  the  hijacking  indicates  a  high  degree  of  planning  and 
perhaps  rehearsals  or  dry  runs.  The  terrorists  were  able  to  board  the  aircraft,  conduct  themselves 
as  airline  security  guards  without  appearing  nervous  or  out  of  place,  and  swiftly  transition  into  the 
execution  mode  without  providing  an  opportunity  for  passengers,  crew,  or  security  forces  to 
intervene. 

However,  their  tactical  objectives  do  not  appear  to  have  been  well-planned  in  advance.  After  the 
hijackers  had  control  of  the  aircraft,  their  demands  shifted  over  time:  from  release  of  prisoners,  to 
French  reparations  for  colonial  rule  and  support  of  the  ruling  regime,296  to  removal  of  obstacles  to 
their  departure. 

Attack 

Because  of  the  successful  intervention  of  the  GIGN,  who  freed  the  remaining  hostages  and  killed 
all  four  hijackers,  the  main  portion  of  the  attack — detonating  explosives  in  midair  or  crashing  the 
airliner  into  the  Eiffel  Tower — was  not  carried  out. 

The  Weapons 

While  the  GIA  was  a  very  well-resourced  group,  it  tended  to  use  simple  weapons  (for  example, 
its  signature  method  of  assassination  was  slitting  the  throat).297  The  weapons  used  in  this  attack 
reflect  that  simple  approach:  the  hijackers  were  armed  with  Kalashnikov  rifles,  Uzi  submachine 
guns,  homemade  grenades,  and  dynamite.298 

While  one  could  draw  inferences  from  this  lack  of  technological  sophistication,  this  simple 
approach  may  have  been  a  deliberate  attempt  to  reduce  chances  of  technical  failure.  Furthermore, 
the  lack  of  security  at  the  airport  allowed  the  use  of  small  arms  and  dynamite,  which  might  have 
been  unfeasible  in  a  more  secure  environment. 

Deployment 

There  is  no  information  available  regarding  how  the  terrorists  staged  for  this  operation.  However, 
they  were  successful  in  gaining  unhindered  access  to  the  aircraft  with  their  weapons. 

Execution 

This  event  should  be  examined  as  two  separate  attacks:  the  hijacking  of  the  airliner  and  the 
intended  destruction  of  the  aircraft  over  Paris  or  the  Eiffel  Tower.  The  hijacking  was  well 
executed;  the  terrorists  were  able  to  gain  unimpeded  access  to  the  aircraft  with  their  weapons, 
inspect  passports,  and  transition  to  taking  control  without  interference.  They  remained  in  control 
of  the  aircraft  from  that  time  until  the  GIGN  team  assaulted  the  aircraft. 

The  execution  of  the  attack  on  Paris,  however,  was  thwarted  prior  to  its  initiation.  An  error  on  the 
part  of  the  hijackers  was  to  land  the  aircraft  at  an  intermediate  location — Marseille — to  onload 
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fuel.  The  distance  from  the  airport  in  Algiers  to  Paris  is  851  nautical  miles;299  the  average  range 
of  a  fully  fueled  A300  (not  accounting  for  altitude,  weather,  or  load)  is  4,160  nautical  miles.300 
Had  the  hijackers  demanded  a  full  fuel  load  in  Algiers,  they  could  have  flown  directly  to  Paris 
and  destroyed  the  aircraft  with  a  great  deal  of  fuel  still  onboard,  rather  than  present  an 
opportunity  for  France  to  deploy  its  well-trained  counterterrorist  force  in  Marseille  to  thwart  the 
operation. 

Consequences 

The  G1A  terrorists  had  minimal  to  moderate  success,  depending  on  which  aspects  of  the  incident 
are  examined.  They  were  able  initiate  part  of  their  attack — the  hijacking — but  were  unable  to 
coerce  the  pilots  and  air  traffic  controllers  into  making  the  airliner  take  off  toward  Paris.  While 
they  were  proficient  in  the  use  of  small  arms  (killing  three  people  and  injuring  others),  it  is  not 
known  whether  they  had  similar  expertise  with  explosives,  since  they  did  not  have  the 
opportunity  to  detonate  them.301 

The  larger  GIA  network  was  not  disrupted  by  this  failed  operation.  The  target  the  terrorists  aimed 
to  ultimately  hit  was  symbolic  if  it  was  the  Eiffel  Tower,  but  if  their  plan  was  to  detonate  the 
explosives  mid-flight,  the  target  would  not  be  considered  symbolic.  Regardless,  there  was  some 
media  coverage  of  this  hijacking,  and  although  there  was  short-term  system  disruption,  there  were 
no  long-lasting  effects  on  the  aviation  system. 

The  psychological  impact  of  the  event  overall  could  be  considered  low,  as  could  the  economic 
effect.  The  French  did  call  for  security  measures  to  be  increased  in  Algeria  before  commercial 
transportation  between  France  and  Algeria  would  be  resumed.302 

Factors  Associated  With  Success  or  Failure 

While  less  is  known  about  this  plot  than  other  cases,  we  still  can  draw  certain  conclusions. 

Training :  It  is  unclear  how  the  terrorists  were  trained  and  if  they  were,  how  extensive  the  training 
was.  What  is  known  is  that  they  were  members  of  the  GIA  which  had  participated  in  other  violent 
attacks. 

Technical  sophistication :  This  attack  did  not  require  a  great  deal  of  technical  sophistication.  The 
terrorists’  weapons  consisted  of  standard  small  arms  and  dynamite,  which  require  little 
specialized  technical  knowledge  to  use. 

Operational  proficiency.  The  early  stages  of  this  attack  demonstrate  a  high  degree  of  operational 
proficiency.  They  were  able  to  board  the  aircraft  with  their  weapons  and  seized  control  quickly. 
However,  their  lack  of  knowledge  regarding  the  capabilities  of  the  aircraft  (particularly  its  range) 
indicate  a  lack  of  proficiency. 

Terrorist  profile  indicators'.  All  hijackers  were  members  of  the  GIA  which  has  a  history  of 
violent  attacks.  At  least  two  of  them  had  been  identified  as  having  taken  part  in  previous  terrorist 
activities. 

Terrorist  OP SEC\  It  appears  that  the  terrorists’  OPSEC  was  initially  good;  they  were  able  to 
procure  Air  Algerie  uniforms  and  badges,  enter  the  airplane  without  arousing  suspicion,  and  get 
the  explosives  on  board.  However,  once  they  hijacked  the  airliner,  their  OPSEC  deteriorated — in 
discussing  the  Paris  phase  of  the  plan  within  earshot  of  hostages  who  were  later  released,  they 
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allowed  important  information  to  come  to  the  attention  of  authorities,  who  then  put  the  plan  in 
motion  to  avert  that  attack. 

Innovation :  This  plot  can  be  considered  unusual  but  not  unprecedented.  While  hijackings  had 
become  relatively  commonplace  and  in  a  few  instances,  terrorists  had  detonated  explosives  on 
airliners  while  in  mid-air,  this  plan  marked  the  first  time  that  terrorists  considered  crashing  an 
aircraft  into  a  target  of  national  significance. 

Technical  difficulties :  The  terrorists  did  not  experience  technical  difficulties  with  the  weapons 
they  carried  onboard.  Additionally,  the  explosives  found  on  board,  if  detonated,  would  have  been 
able  to  destroy  the  airliner.  However,  it  appears  that  the  terrorists  did  not  know  how  to  fly  the 
airliner  themselves  and  thus  had  to  rely  on  the  Air  France  pilots.  Their  plot  might  have  turned  out 
differently  had  they  known  how  to  pilot  the  aircraft  themselves. 

Access'.  Access  to  the  target  aircraft  was  nominally  hindered  by  security  guards  and  other 
measures,  but  these  barriers  to  access  were  easily  circumvented  by  the  use  of  disguise  and  false 
documentation. 

Law  enforcement  or  intelligence  knowledge'.  According  to  the  open  sources,  law  enforcement  and 
intelligence  officials  did  not  have  any  knowledge  of  this  event  before  it  occurred. 

Security  environment :  The  security  environment  in  Algiers  could  be  considered  highly 
restrictive — the  country  had  been  under  military  control  since  1992,  and  the  government  had 
jailed  thousands  of  terrorists  and  insurgents.303  However,  the  apparent  ease  with  which  the 
terrorists  were  able  to  circumvent  security  indicates  that  certain  aspects  of  the  security 
environment  were  lax. 

Effective  information  sharing :  It  appears  that  both  the  Algerians  and  the  French  wanted 
jurisdiction  over  the  incident,  delaying  the  terrorist-requested  journey  from  Algeria  to  France. 
However,  cooperation  eventually  was  achieved,  and  the  GIGN  was  able  to  practice  on  an 
identical  airliner  before  the  actual  rescue  mission. 

International  cooperation :  Cooperation  between  the  French  and  Algerian  governments  was  poor, 
as  evidenced  by  the  disagreement  over  jurisdiction  and  whether  the  aircraft  should  be  allowed  to 
take  off. 

Other  factors'.  All  four  terrorists  were  dressed  in  Air  Algerie  uniforms  and  had  identification 
badges,  therefore  not  causing  suspicion  on  the  part  of  airport  and  airline  personnel  or 
passengers.304  This  can  be  considered  a  use  of  deception  that  worked  in  favor  of  the  terrorists  and 
allowed  them  to  successfully  board  and  hijack  the  Air  France  flight. 

The  French  GIGN  commandos  were  highly  proficient  in  hostage  rescue.  Training  for  a  new 
member  of  the  force  typically  takes  three  years  to  complete,  testifying  to  the  level  of  proficiency 
expected  of  GIGN  members.  305  Because  the  French  had  this  resource  available  to  them,  they  were 
able  to  free  all  of  the  hostages  and  prevent  the  execution  of  the  Paris  phase  of  the  plot.  The 
availability  of  this  force  should  be  considered  a  factor  that  led  to  the  failure  of  that  phase  of  the 
attack  at  the  tactical,  operational,  and  strategic  levels. 

Findings 

The  GIA  terrorists  exhibited  a  high  degree  of  innovation,  both  in  the  use  of  disguises  to  overcome 
accessibility  issues  and  in  the  plan  to  use  the  aircraft  itself  as  a  weapon.  However,  they  also 
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exhibited  major  lapses  in  planning  and  execution — for  example,  lack  of  familiarity  with  the  fuel 
load  and  range  of  the  aircraft  and  failure  to  maintain  OPSEC  in  front  of  their  hostages.  These 
lapses  created  opportunities  seized  upon  by  French  security  authorities.  However,  the  idea  of 
using  an  aircraft  in  this  manner  would  be  seen  in  subsequent  years,  in  better-planned  operations, 
and  with  greater  success  at  all  three  levels. 
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Operation  Bojinka — December  1994- 
January 1995 

Overview 

Today  the  idea  of  destroying  a  commercial  aircraft  in  flight  or  using  an  airliner  as  a  weapon  does 
not  seem  particularly  innovative.  That  was  not  the  case  in  early  1995,  when  a  plot  was  uncovered 
that  aimed  to  use  liquid  nitroglycerin  bombs  to  destroy  as  many  as  12  airliners  simultaneously.106 

The  plot  was  the  creation  of  Ramzi  Y ousef,  who  was  a  veteran 
terrorist  and  the  mastermind  of  the  1 993  plot  to  destroy  the 
World  Trade  Center.107  In  his  plan,  nitroglycerin-based  bombs 
would  be  smuggled  on  board  the  airliners  in  innocuous- 
appearing  components:  a  contact  lens  solution  bottle,  a  Casio 
watch,  and  a  detonator  hidden  in  the  heel  of  a  shoe.108  The 
terrorist  would  assemble  and  arm  the  weapon,  then  leave  the 
aircraft  at  an  intermediate  stop.  The  timers  were  set  to  detonate 
the  explosives  while  the  aircraft  were  flying  on  subsequent  legs  of  their  journeys,  and  the  aircraft 
would  be  destroyed  within  hours  of  each  other.109 

Another  aspect  of  the  Bojinka  plot  was  the  possible  hijacking  of  a  plane  in  the  United  States. 
Similar  to  the  Air  France  incident,  the  plan  was  to  use  the  aircraft  as  a  weapon  and  crash  it  into 
the  headquarters  of  the  Central  Intelligence  Agency,  but  in  this  plot,  the  hijacker  himself  would 
take  control  of  the  aircraft  and  guide  it  to  its  target.110 

The  Bojinka  plot  progressed  a  great  deal  toward  the  execution  phase.  Yousef  had  constructed  test 
bombs  and  carried  out  dry  runs,  even  detonating  a  bomb  on  a  Philippines  Airlines  flight  to  test  the 
validity  of  the  plan.  However,  the  plotters  made  a  mistake  while  mixing  a  batch  of  explosives, 
starting  a  fire  that  drew  the  attention  of  Philippines  authorities.  The  Filipinos  pursued  the  case  and 
forced  the  plotters  to  abandon  their  plan,  and  the  plotters  fled  the  country.  They  were  later 
apprehended  and  brought  to  the  United  States  to  stand  trial.111 

Significance  of  the  Incident 

The  Bojinka  plot  involved  the  innovative  use  of  liquid  explosives  to  circumvent  screening 
procedures  and  destroy  several  airliners  simultaneously.  A  nearly  identical  attempt  was  thwarted 
over  a  decade  later,  when  British  authorities  arrested  approximately  20  men  believed  to  be 
preparing  to  destroy  U.S.  airliners  headed  from  the  United  Kingdom  to  the  United  States.  The 
secondary  plot  to  destroy  CIA  headquarters  similarly  foreshadows  the  September  11,  2001 
attacks.  It  is  noteworthy  that  the  later  plot  targeted,  among  other  landmarks,  the  World  Trade 
Center,  which  Yousef  failed  to  destroy  in  1993. 

These  innovations  are  significant  in  and  of  themselves,  but  they  also  demonstrate  a  tendency  of 
terrorist  groups  (al  Qaeda  in  particular)  to  learn  from  their  previous  actions  and  those  of  others. 
They  resurrect  tactics  and  refine  them,  and  they  often  revisit  targets  that  escaped  destruction  in 
earlier  incidents. 


Type  of  Attack:  Planned 
detonation  of  liquid  explosives 
aboard  multiple  airliners  while  in 
flight 

Date:  December  1994-January 
1995 

Individuals  Involved: 

Experienced  Islamic  terrorists 
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Description  of  the  Group  or  Individuals  Involved 

Ramzi  Yousef  was  the  central  figure  in  this  plot.  His  nationality  is  unclear — there  is  speculation 
that  his  father  was  from  the  Baluchistan  region  of  Pakistan,  but  Yousef  (whose  actual  name  may 
be  Abdul  Basit  Karim)  was  raised  in  Kuwait.  His  father  was  a  guest  worker  there,  and  so  the 
members  of  the  family  were  probably  treated  as  second-class  citizens.312  Nevertheless,  Yousef 
was  educated  at  the  university  level  in  the  U.K.,  where  he  studied  electrical  engineering.313  He 
came  to  the  United  States  in  1992  with  a  forged  Iraqi  passport;  his  traveling  companion  was 
arrested  when  his  passport  was  determined  to  be  fake  and  bomb-making  plans  were  found  in  his 
luggage.  Yousef,  however,  was  able  to  enter  the  United  States.  He  became  a  follower  of  the 
radical  cleric  Omar  Abdel  Rahman  and  eventually  conceived  the  plot  to  detonate  a  van  of 
explosives  under  the  World  Trade  Center.  After  that  plot  failed  to  achieve  its  desired  results,  he 
fled  the  United  States  and  moved  to  Pakistan,  where  he  lived  in  safe  houses  financed  by  Osama 
bin  Laden. 314 

Yousefs  uncle  was  Khalid  Sheikh  Mohammed,  who  was  bom  in  Kuwait.  He  was  educated  in  the 
United  States,  studying  mechanical  engineering  first  at  a  small  Baptist  college  and  then 
transferring  to  North  Carolina  Agricultural  and  Technical  University.315  After  graduation  in  1986, 
he  went  to  Afghanistan  to  join  the  resistance  against  the  Soviet  occupation.  Mohammed  had  a 
peripheral  role  supporting  his  nephew’s  plot  against  the  World  Trade  Center,  and  this  may  have 
provided  the  impetus  for  his  own  transformation  into  terrorist  planner.  Following  the  Bojinka 
plot,  he  went  on  to  become  the  principal  force  behind  the  September  1 1  attacks,  as  well  as  the 
Richard  Reid  shoe  bomb  plot,  the  killing  of  reporter  Daniel  Pearl,  and  the  attacks  in  Bali.316 

Abdul  Hakim  Murad ,317  also  known  as  Saeed  Akman,  was  born  in  Kuwait  on  January  4,  1968, 
and  grew  up  in  a  Palestinian  enclave  there,  where  his  hatred  of  both  the  United  States  and  Israel 
developed.  He  was  childhood  friends  with  Ramzi  Yousef.318  Murad  moved  to  the  United  States  in 
November  1991  and  took  flying  lessons,  leading  to  a  commercial  pilot  rating.319  Murad,  like 
Yousef,  had  been  involved  in  earlier  terrorist  planning;  in  fact,  Murad  chose  the  World  Trade 
Center  as  the  target  for  Yousef  s  1993  attack.320 

Wali  Khan  Amin  Shah  is  variously  thought  to  have  Turkmen,  Saudi,  or  Russian  nationality.321  He 
was  bom  on  April  2,  1966.  His  principal  role  was  as  financier,  although  he  reportedly  planted  a 
bomb  used  in  a  dry  run  at  a  theater  in  Manila.322 

Motivation 

According  to  FBI  sources,  the  plotters  wanted  “to  make  the  American  people  and  the  American 
government  suffer  for  their  support  of  Israel.”323  Yousef  claimed  that  America’s  support  of  Israel 
gave  Lebanese  and  Palestinians  the  right  to  attack  American  targets.324  A  letter  found  on  Yousef  s 
computer  stated  that  the  Bojinka  plot  was  “in  response  to  the  financial,  political  and  military 
assistance  given  to  the  Jewish  State  in  the  occupied  land  of  Palestine  by  the  American 
Government.”325  “All  people  who  support  the  U.S.  government  are  our  targets  in  our  future  plans 
and  that  is  because  all  those  people  are  responsible  for  their  government’s  actions  and  they 
support  the  U.S.  foreign  policy  and  are  satisfied  with  it,”  the  document  continued.326 
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Planning 

Operation  Bojinka  was  well  planned  by  these  experienced  terrorists.  Yousef  had  thoroughly 
researched  trans-Pacific  flight  schedules  for  U.S.  air  carriers,  selecting  targets  that  would  be  in 
the  air  at  approximately  the  same  time  for  nearly  simultaneous  destruction.327  Yousefs  planning 
also  included  design  of  a  weapon  that  would  best  be  able  to  pass  undetected  through  airport 
screening.  He  selected  nitroglycerine  as  the  main  component  of  the  explosive  because  screening 
techniques  at  that  time  would  not  have  detected  its  presence.328  The  components  also  were 
selected  because  contact  lens  solution  and  sports  watches  were  commonplace  items  carried  on 
board  airliners  and  would  not  be  scrutinized.329  Planning  was  supported  by  extensive  training; 
Murad  told  authorities  after  his  arrest  that  he  had  spent  1 8  days  in  Pakistan  training  in  the  use  of 
explosives.330 

Finally,  the  terrorists  conducted  several  tests  of  their  weapons  and  dry  runs  of  the  attack:  these 
included  placing  a  bomb  in  the  Greenbelt  Theater  in  Manila  on  December  1,  1994,331  and 
detonating  a  small  version  of  the  bomb  on  a  Philippines  Airlines  flight  later  that  month,  killing 
one  passenger.332  The  details  of  that  test  run  indicate  the  sophistication  of  Yousef  s  planning.  He 
boarded  the  Philippines  Airlines  747  and  once  in  flight  assembled  the  bomb  components  in  the 
lavatory.  He  returned  and  planted  the  bomb  under  his  seat  in  the  lifejacket.  Yousef  disembarked 
in  the  Philippine  city  of  Cebu,  and  the  flight  took  off  again  on  its  way  to  Tokyo,  with  a  new 
passenger  in  Yousefs  seat.  Two  hours  into  the  second  flight,  the  bomb  exploded  and  killed  the 
Japanese  businessman  in  that  seat.  The  bomb  breeched  the  skin  of  the  aircraft,  but  the  pilot 
managed  to  jettison  fuel  and  make  an  emergency  landing,  avoiding  further  casualties.333 
According  to  an  FBI  source,  Murad  told  him  that  Philippines  Airlines  Flight  434  was  used  as  “a 
test  to  make  sure  the  timing  devices  worked  properly.”334  Furthermore,  Yousef  learned  from  this 
dry  run  that  more  explosive  would  be  required  to  destroy  the  aircraft;  this  demonstrates  another 
instance  of  terrorist  learning.335 

Attack 

The  attack  did  not  reach  the  execution  phase  owing  to  an  incident  that  occurred  as  Yousef  and 
Murad  were  preparing  a  batch  of  nitroglycerin.  A  fire  broke  out,  and  their  apartment  building  was 
evacuated.  Although  they  had  both  fled,  Y ousef  insisted  that  Murad  return  to  the  apartment  to 
retrieve  a  laptop;  this  seemed  suspicious  to  authorities,  who  detained  Murad.  When  questioned, 
he  gave  the  name  Ahmed  Saeed  (he  was  actually  Murad)  and  said  he  was  a  commercial  pilot.  The 
authorities  searched  the  apartment  and  found  various  explosive  ingredients  including  pure 
glycerin,  acetone  and  various  acids,  thermometers,  beakers,  timers,  circuit  breakers,  hotplates, 
cotton  soaking  in  liquid,  plastic  containers,  multicolored  electrical  wiring,  and  chemistry 
reference  manuals.  As  they  searched  the  apartment  another  man  was  standing  outside  on  a  cell 
phone.  It  was  later  determined  that  it  was  Yousef,  but  he  escaped  in  the  small  firefight  that  ensued 
as  Saeed  (Murad)  attempted  to  flee.336 

Authorities  also  found  a  laptop  (the  one  for  which  Murad  had  returned  to  the  apartment)  with 
encrypted  files  they  were  able  to  access.  These  files  contained  great  detail  about  the  airline  plot, 
including  flight  schedules  and  an  outline  of  the  attack  plan.  The  computer  also  included 
information  linking  the  plotters  to  Mohammed  and  Khan  and  to  the  plot  to  crash  an  airliner  into 
CIA  headquarters.  A  third  aspect  of  Bojinka — a  plot  to  assassinate  Pope  John  Paul  II  during  his 
impending  visit  to  Manila — was  also  detailed  in  documents  on  the  computer.337 
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Consequences 

This  plot  was  not  a  success;  the  terrorists  were  not  able  to  detonate  their  explosives  on  board 
multiple  airliners  as  they  had  intended.  It  is  estimated  that  4,000  people  could  have  died  if  the 
plot  had  been  carried  out  as  the  terrorists  planned.338  However,  because  authorities  capitalized  on 
the  windfall  of  information  and  averted  the  execution  of  the  plot,  the  only  casualty  was  the 
Japanese  businessman  killed  during  the  dry  run  and  the  10  who  were  injured  by  that  bomb.339 

There  was  only  minor  impact,  primarily  in  the  form  of  media  attention  (which  surfaced  again 
after  the  September  1 1  attacks  and  the  liquid  explosives  plot  in  August  2006).  However,  a 
significant  indicator  of  operational-level  failure  is  the  dismantling  of  the  terror  network  which 
followed  the  investigation  into  the  plot. 

There  is  no  evidence  that  the  Western  public  was  psychologically  traumatized  or  that  the  airline 
or  tourist  industries  suffered  due  to  this  attempt.  Likewise,  there  is  no  information  indicating  a 
positive  or  negative  impact  on  potential  supporting  populations,  and  no  changes  in  foreign  policy 
or  security  measures  resulted  from  the  plot. 

Security  services  learned  from  the  Bojinka  plot  that  terrorists  were  aware  that  existing  measures 
to  detect  explosives  were  not  effective.  According  to  one  source,  the  Federal  Aviation 
Administration  began  installing  “sniffer”  machines  at  major  U.S.  airports  shortly  after  the  plot 
was  uncovered.340  However,  the  terrorists  had  learned  a  different  lesson,  according  to  a  senior 
Philippines  official:  explosives  were  unstable,  expensive,  and  difficult  to  handle.  They  would 
seek  other  methods  to  destroy  aircraft  that  did  not  have  these  disadvantages.341 

Factors  Associated  With  Success  or  Failure 

A  number  of  factors  contributed  to  the  outcome  of  this  operation. 

Training :  The  terrorists  attended  flight-training  schools,  had  the  know-how  to  create  bomb 
components,  conducted  successful  test  runs,  and  possibly  had  the  financial  backing  of  a  larger 
terrorist  organization.  They  appeared  to  be  well-disciplined  planners. 

Technical  sophistication :  Although  Yousef  demonstrated  technical  sophistication  when  his  test 
bombs  detonated  as  designed,  the  mishandling  of  chemicals  in  the  apartment  began  the  chain  of 
events  which  led  to  the  disruption  of  the  plot. 

Operational  proficiency.  Ramzi  Yousefs  successful  test  run  on  the  Philippines  Airlines  flight 
indicates  he  was  highly  proficient  at  covertly  transporting  the  explosive  elements  onto  the 
aircraft,  assembling  the  weapon,  setting  the  timer,  and  placing  the  bomb  where  it  would  not  be 
detected  before  detonating. 

Terrorist  profile  indicators:  Yousef,  Murad,  and  Mohammed  all  were  known  to  be  involved  in 
the  1993  World  Trade  Center  attacks.  This  operational  history  would  be  considered  a  strong 
indicator  highlighting  them  for  attention  by  security  services. 

Terrorist  OP  SEC:  The  failure  of  this  otherwise  well-planned  plot  at  all  three  levels  can  be 
directly  attributed  to  lapses  in  OPSEC.  First,  Murad  exhibited  suspicious  behavior  by  attempting 
to  return  to  the  apartment  before  being  given  the  all-clear.  Second,  and  more  important,  the 
extensive  documentation  of  the  plot  on  the  computer — although  encrypted — enabled  authorities 
to  disrupt  the  plot  prior  to  its  execution. 
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There  were  other  lapses  in  OPSEC  as  well.  When  Murad  and  Y ousef  checked  into  the  apartment, 
they  initially  filled  out  the  registration  cards  in  their  true  names,  then  asked  for  the  cards  back  and 
filled  out  new  ones.  They  also  refused  to  allow  a  security  guard  into  the  apartment  when  smoke 
first  appeared  and  had  not  permitted  hotel  cleaning  staff  to  access  their  room  during  their  stay.342 

Innovation-.  This  plot  was  highly  innovative  in  several  aspects.  The  use  of  a  liquid  explosive  was 
a  new  means  of  attack,  and  Yousefs  success  in  bypassing  security  on  the  test  run  may  have  been 
used  as  a  learning  point  by  the  plotters  in  the  liquid  explosives  plot  in  2006.  The  simultaneous 
destruction  of  airliners  was  likewise  unique  and  possibly  a  learning  point.  Finally,  the  use  of  an 
aircraft  to  destroy  a  building,  along  with  the  nearly  contemporaneous  Air  France  plot,  was  an 
innovation  that  was  later  employed  by  Khalid  Sheikh  Mohammed  when  he  planned  the 
September  1 1  attacks. 

Technical  difficulties :  Yousef  and  Murad  mishandled  chemicals  in  the  apartment,  leading  to  the 
fire  and  the  discovery  of  the  plot.  Although  this  appears  to  be  the  only  technical  difficulty 
encountered,  it  had  significant  impact  on  the  outcome  of  the  plot. 

Law  enforcement  or  intelligence  knowledge :  The  Philippine  security  services  capitalized  on  their 
fortuitous  acquisition  of  incriminating  information.  By  recognizing  the  importance  of  this 
windfall,  they  were  able  to  pursue  leads  discovered  at  the  apartment  and  disrupt  the  Bojinka  plot. 

Security  environment.  The  security  environment  can  be  considered  permissive.  As  stated  in  a 
report  by  the  Council  on  Foreign  Relations,  “Philippine  antiterrorist  efforts  have  been 
undermined  by  weak  and  sometimes  corrupt  law  enforcement.”  343  Thus,  the  diligence  of  the 
authorities  in  this  case  was  an  exception  to  the  norm. 

Effective  information  sharing :  Information  sharing  was  effective.  The  local  police  passed 
information  to  the  national  authorities,  who  had  the  technical  means  and  intelligence  capability  to 
capitalize  on  the  details.344 

International  cooperation :  International  cooperation  was  generally  good.  The  Philippine  National 
Police  contacted  the  CIA  station  chief  and  FBI  legal  attache,  seeking  their  assistance.345 

Findings 

The  outcome  of  this  plot  demonstrates  the  sensitivity  of  terrorist  attacks  to  the  OPSEC  factor. 

This  was  a  very  well-planned  and  well-rehearsed  operation  that  likely  would  have  been  executed 
successfully.  Only  two  factors  worked  against  the  adversary:  improper  fabrication  of  the 
explosive  and  poor  OPSEC,  which  allowed  authorities  to  discover  details  of  the  plan  while 
investigating  the  subsequent  fire. 

This  case  also  demonstrates  that  this  factor  has  impact  only  when  combined  with  other  factors,  in 
this  case  the  alertness  of  the  local  police  and  the  ability  to  realize  the  importance  of  unexpected 
windfalls  of  information.  Poor  OPSEC  would  not,  on  its  own,  have  led  to  the  interruption  of  the 
plot;  it  was  only  when  combined  with  the  reaction  of  the  security  forces  that  conditions  were  set 
that  led  to  failure. 
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The  Attacks  on  the  World  Trade  Center 
and  the  Pentagon — September  11,  2001 


Overview 

On  the  morning  of  September  11,  2001,  19  young  men  affiliated  with  al  Qaeda  hijacked  four 
commercial  American  airliners.  Two  of  the  airliners  crashed  into  the  World  Trade  Center 
buildings  in  New  York  City,  one  flew  into  the  side  of  the 
Pentagon  in  Arlington,  Virginia,  and  a  fourth  was  flown  into 
the  ground  in  Shanksville,  Pennsylvania,  presumably  after 
passengers  overpowered  the  hijackers.  Nearly  3,000  people 
were  killed  as  a  result  and  many  more  were  injured.  This 
series  of  coordinated  attacks  was  the  worst  terrorist  event  in 
the  history  of  the  United  States. 


Type  of  Attack:  Hijacked  airliners 
flown  into  the  World  Trade  Center, 
the  Pentagon,  and  a  field  in 
Shanksville,  PA 
Date:  September  11,  2001 
Group  Type:  al  Qaeda  affiliated 
individuals 


Significance  of  the  Incident 

More  people  were  killed  in  the  attacks  of  September  11,  2001,  than  in  any  single  terrorist  attack 
that  had  occurred  previously  against  U.S.  targets — this  is  one  of  the  reasons  that  this  event  is 
significant.  In  addition,  unlike  al  Qaeda’s  attacks  against  American  targets  in  East  Africa  and  the 
Saudi  Arabian  peninsula,  this  event  occurred  at  home,  marking  a  new  chapter  in  al  Qaeda’s  war 
against  the  West.  This  operation  also  stands  out  for  its  innovation — this  was  the  first  time  that  a 
terrorist  group  had  successfully  used  commandeered  airlines  to  kill  people  and  destroy  buildings. 
As  the  more  recent  plot  to  destroy  U.S.  airliners  using  liquid  explosives  indicates,  terrorists 
remain  interested  in  attacking  the  aviation  sector  and  likely  have  the  ability  to  do  so. 


Description  of  the  Group  or  Individuals  Involved 

The  attack  cell  responsible  for  carrying  out  the  hijackings  on  September  1 1  consisted  of  19  men, 
all  of  whom  spent  time  in  the  United  States  prior  to  the  attacks.  Fifteen  of  the  terrorists  had  Saudi 
Arabian  citizenship  and  the  other  four  hailed  from  Egypt,  the  United  Arab  Emirates,  or 
Lebanon.346 

One  of  the  oldest  of  the  19  hijackers  and  considered  the  tactical  leader  of  the  plot,  Mohammed 
Atta  was  bom  in  Egypt  in  1968  to  a  middle-class  family  and  later,  in  July  1992,  moved  to 
Elamburg,  Germany,  to  complete  his  master’s  degree,  having  graduated  from  Cairo  University 
with  a  degree  in  architectural  engineering.347  During  his  time  in  Germany,  Atta  was  a  serious 
student  and  became  increasingly  religious,  trying  to  organize  a  Muslim  association  at  his  school, 
the  Technical  University  of  Hamburg-Harburg.  Over  the  years  he  studied  in  Elamburg,  Atta 
became  “abrasive  and  increasingly  dogmatic,”  and  his  friends  from  those  days  recall  him  as  an 
intelligent  and  charismatic  decision-maker  who  did  not  tolerate  dissent.348  Fellow  students 
remember  that  he  was  intensely  anti-American  and  anti-Semitic,  and  within  his  circle  of 
acquaintances,  Atta  “advocated  violent  jihad.”349 

While  living  in  Germany,  Atta  met  and  became  friends  with  some  of  those  who  would  later  join 
him  in  carrying  out  the  attacks  of  September  1 1.  In  April  1996,  Mar-wan  al  Shehhi,  a  citizen  of 
the  United  Arab  Emirates,  arrived  in  Germany,  to  study  in  a  program  funded  by  a  military 
scholarship.  Unlike  Atta,  al  Shehhi  was  not  a  dedicated  student,  but  he  and  Atta  did  share  a 
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similar  devotion  to  the  Muslim  faith.  A1  Shehhi  moved  to  Hamburg  in  1998,  and  Atta  moved  into 
his  apartment  shortly  thereafter,  but  the  location  and  timing  of  their  first  meeting  is  uncertain. 
From  this  point  forward,  al  Shehhi  became  more  dedicated  to  a  fundamentalist  strain  of  Islam, 
living  frugally  and  telling  people  that  “he  was  living  the  way  the  Prophet  had  lived.”350 

Ziad  Jarrah,  who  would  later  pilot  United  Airlines  Flight  93,  also  met  Atta  during  his  time  in 
Hamburg.  Jarrah,  who  was  bom  in  Lebanon  to  an  affluent  family,  may  have  become  acquainted 
with  Atta  through  Ramzi  Binalshibh,  who  supposedly  was  to  have  been  part  of  the  team  that 
conducted  the  September  1 1  attacks.351  Like  Atta  and  al  Shehhi,  Jarrah  came  to  Germany  for 
academic  reasons  and  enrolled  in  a  college  in  Griefswald,  where  he  met  a  Turkish  woman  who 
would  later  become  his  wife.  The  following  year,  in  1997,  Jarrah  moved  to  Hamburg,  where  he 
enrolled  in  the  Technical  University  of  Hamburg-Harburg  and  began  taking  aircraft  engineering 
classes.  At  some  point  during  his  time  in  Hamburg,  Jarrah  made  Atta’s  acquaintance,  although 
the  timing  and  circumstances  of  this  meeting  are  uncertain.  Those  who  knew  Jarrah  in  Hamburg 
remembered  that  he  became  increasingly  devoted  to  religion  in  the  years  he  spent  there,  and  he 
spent  more  and  more  time  praying.  Reportedly,  in  1 999,  he  told  his  girlfriend  that  he  was 
“planning  to  wage  a  jihad  because  there  was  no  greater  honor  than  to  die  for  Allah.”352 

These  three  men — Mohammed  Atta,  Marwan  al  Shehhi,  and  Ziad  Jarrah — formed  something  of  a 
core  around  which  the  other  hijackers  would  eventually  coalesce,  and  all  three  would  serve  as 
pilots  on  the  ill-fated  flights  of  September  11,  2001.  In  1999,  they  traveled  to  Afghanistan,  where 
they  pledged  loyalty  to  Osama  bin  Laden  and  were  subsequently  told  that  they  would  be  taking 
part  in  a  secret  mission.  Atta  was  chosen  by  bin  Laden  to  be  the  leader  of  the  operation,  and  by 
the  time  the  three  men  left  Afghanistan,  they  had  plans  to  enroll  in  flight  training  classes.353  (See 
the  “Planning”  section  for  more  information  on  events  that  occurred  prior  to  the  attacks  on 
September  11,  2001.) 

Others  involved  in  the  hijackings  likely  either  grew  up  together  or  near  one  another  or  met  while 
training  in  Afghanistan.  Four  of  the  hijackers — Ahmed  al  Ghamdi ,  Hamza  al  Ghamdi,  Saeed  al 
Ghamdi,  and  Ahmad  al  Haznawi — came  from  three  small  towns  located  in  proximity  to  each 
other  in  an  isolated  part  of  Saudi  Arabia,  and  five  others  came  from  the  Asir  Province,  also  in 
Saudi  Arabia.354  All  of  these  men,  the  so-called  “muscle  hijackers,”  developed  connections  to 
extremists  two  or  three  years  prior  to  the  2001  attacks.355  Unlike  Atta,  al  Shehhi,  and  Jarrah, 
acquaintances  did  not  recall  that  these  men  had  become  increasingly  devout  or  fanatic  in  the 
months  before  the  attacks.  Some  of  them  were  religious,  but  not  unusually  so,  and  others  were 
more  likely  to  violate  Islamic  laws  by  drinking  alcohol.356 

Regardless  of  these  differences,  by  early  2000,  the  future  hijackers  began  displaying  similar 
behavior — family  members  revealed  that  the  men  began  seeing  less  of  their  families  and  started 
taking  trips  to  undisclosed  locations  during  this  period.  In  retrospect,  it  is  clear  that  these 
absences  allowed  the  terrorists  the  opportunity  to  begin  planning  and  training,  in  earnest,  for  the 
events  of  September  11,  2001. 357 

Motivation 

The  attacks  were  ordered  by  Osama  bin  Laden,  and  the  motivation  for  this  operation  appears  to 
have  come  directly  from  bin  Laden  and  his  associate,  Khalid  Sheikh  Mohammed  (KSM).358  KSM 
was  violently  opposed  to  what  he  saw  as  American  favoritism  toward  Israel,  and  according  to 
information  provided  during  his  interrogations,  this  was  what  drove  him  to  consider  the 
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possibility  of  attacks  against  the  United  States.  359  Further,  he  was  well-aware  of  the  impact  of  the 
first  World  Trade  Center  attack  in  1993,  because  his  nephew,  Ramzi  Yousef,  had  been  the 
mastermind  of  that  operation,  and  KSM  wanted  to  carry  out  an  attack  of  even  greater  magnitude. 
In  fact,  according  to  KSM,  had  it  not  been  for  Yousef  s  involvement  in  the  1993  attack  and 
KSM’s  relation  to  him,  bin  Laden  would  have  been  less  willing  to  meet  with  KSM  to  discuss 
future  operations.  Bin  Laden  was  impressed  with  Yousef,  and  it  appears  that  this  proved 
beneficial  to  his  uncle — bin  Laden  agreed  to  meet  with  KSM,  and  it  was  at  this  meeting  that  KSM 
presented  his  proposal  for  crashing  airliners  into  buildings  in  the  United  States,  a  plan  which 
would  take  advantage  of  the  various  means  of  attacking  aircraft  that  can  be  used  against  the 
commercial  aviation  sector,  as  mentioned  earlier.360 

Khalid  Sheikh  Mohammed  believed  that  an  attack  such  as  this — with  its  potential  to  damage  the 
American  economy — would  be  the  most  effective  means  of  influencing  U.S.  foreign  policy.361  He 
saw  New  York  City  as  the  economic  center  of  the  United  States  and  likely  viewed  Washington, 
D.C.,  including  the  nearby  Pentagon,  as  the  heart  of  the  country’s  governmental  power.  For  the 
same  reasons  that  the  World  Trade  Center  was  an  attractive  target  to  Yousef  in  1993,  it  remained 
a  compelling  objective  for  al  Qaeda  eight  years  later.  The  sheer  size  of  the  World  Trade  Center 
complex  and  the  Pentagon  made  them  appealing  to  al  Qaeda.  Buildings  such  as  these  would 
contain  thousands  of  people,  and  attacks  on  them  would  likely  result  in  a  high  number  of 
casualties.  In  addition,  an  attack  of  such  magnitude  would  be  expected  to  provoke  a  response 
from  the  United  States.  Bin  Laden  and  KSM  anticipated  that  such  a  reaction  could  be  portrayed 
as  an  attack  against  all  of  Islam  and  might  result  in  a  backlash  against  the  United  States  that  could 
benefit  al  Qaeda.362 

Planning 

After  his  arrest,  Khalid  Sheikh  Mohammed  revealed  that  following  al  Qaeda’s  attacks  on  the  U.S. 
embassies  in  Nairobi  and  Dar  es  Salaam  in  1998,  he  recognized  bin  Laden  was  serious  about 
attacking  the  United  States.  Although  KSM  had  entertained  the  idea  of  a  September  1 1 -type 
attack  for  years,  possibly  learning  from  and  refining  the  plan  for  the  failed  Operation  Bojinka,  it 
was  this  realization  that  prompted  him  to  approach  bin  Laden  about  backing  the  operation.  In  the 
first  few  months  of  1999,  bin  Laden,  KSM,  and  Mohammed  Atef,  a  senior  al  Qaeda  military 
commander,  met  to  discuss  the  plot  and  to  develop  an  initial  target  list.  These  included  the  White 
House,  the  U.S.  Capitol,  the  Pentagon,  and  the  World  Trade  Center.363 

Having  received  bin  Laden’s  endorsement  and  guidance  on  target  selection,  KSM  moved  forward 
with  the  plot,  and  it  seems  that  planning  began  in  earnest  in  early  2000,  after  Atta,  al  Shehhi,  and 
Jarrah  returned  from  their  trip  to  Afghanistan.364  After  returning  to  Germany,  the  three  men  tried 
not  to  arouse  suspicion,  and  they  distanced  themselves  from  known  extremists  and  stopped 
spending  time  at  radical  mosques.365 

One  of  the  key  aspects  of  planning  the  attack — learning  how  to  fly  airliners — occupied  the 
attention  of  the  hijackers  during  this  time.  All  three  men  considered  attending  flight  schools  in 
Europe,  but  after  being  informed  that  flight  instruction  in  the  United  States  was  less  expensive 
and  could  be  accomplished  more  quickly  than  at  schools  in  Germany  or  elsewhere  in  Europe, 

Atta,  al  Shehhi,  and  Jarrah  decided  that  they  would  travel  to  the  United  States  for  instruction.366 
Atta  contacted  more  than  30  American  flight  schools,  and  between  January  and  May  2000,  all 
three  men  obtained  visas  to  travel  to  the  United  States.367 
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Available  evidence  suggests  that  the  hijackers’  airline  tickets  to  the  United  States,  their  living 
expenses  once  they  arrived,  and  the  fees  associated  with  flight  training  were  funded  by  al 
Qaeda.368  The  money  was  provided  in  cash  by  Khalid  Sheikh  Mohammed  and  through  wire 
transfers.  Ali  Abdul  Aziz,  a  nephew  of  KSM,  wired  funds  from  Dubai  to  the  hijackers;  much  of 
this  money  was  used  to  pay  for  flight  training  for  the  four  men  who  would  pilot  the  planes  on 
September  11.  Aziz  was  not  required  to  present  identification  when  he  wired  the  money,  and  all 
of  his  transactions  were  small  and  “were  essentially  invisible  amid  the  billions  of  dollars  flowing 
daily  across  the  globe.”369  Ramzi  Binalshibh,  a  close  associate  of  the  hijackers,  also  provided 
funding  to  them,  wiring  money  to  a  Sun  Trust  Bank  account  in  Florida.370  Several  of  the  “muscle 
hijackers”  brought  money  with  them  when  they  came  to  the  United  States,  and  at  least  seven  of 
them  purchased  approximately  $50,000  in  travelers’  checks.371 

After  arriving  in  the  United  States,  those  who  would  be  piloting  the  airliners  on  September  11, 
2001,  focused  on  their  flight  training.  In  order  to  complete  the  attacks  as  planned,  at  least  four  of 
the  hijackers  would  need  to  be  able  to  fly  a  commercial  airliner,  navigate  it  to  the  desired 
location,  and  direct  the  plane  into  the  designated  target.372  By  November  2000,  Mohammed  Atta, 
who  would  pilot  American  Airlines  Flight  11,  and  Marwan  al  Shehhi,  who  would  take  over  the 
controls  of  United  Airlines  Flight  175,  had  completed  their  flight  training  and  had  received  their 
instrument  certificates  from  the  Federal  Aviation  Administration.  The  following  month,  they 
passed  the  commercial  pilot’s  test  and  received  their  licenses.  Around  the  same  time,  Ziad  Jarrah, 
who  would  later  fly  United  Airlines  Flight  93  into  a  field  in  Shanksville,  Pennsylvania,  began 
training  on  a  flight  simulator,  giving  him  practice  in  piloting  large  jets;  Atta  and  al  Shehhi  did  the 
same.373  Hani  Hanjour,  who  would  later  fly  American  Airlines  Flight  77,  had  received  his  pilot 
credentials  earlier  than  the  other  three,  having  been  granted  a  commercial  multi-engine  pilot 
certificate  in  March  1999.  Hanjour  also  had  taken  flight  simulator  training,  and  he  may  have  been 
“the  most  experienced  and  highly  trained  pilot”  among  the  hijackers.374 

Meanwhile,  the  “muscle  hijackers”  traveled  to  Afghanistan,  where  they  received  training  from 
Abu  Turab  al  Jordani,  “one  of  only  a  handful  of  al  Qaeda  operatives  who  .  .  .was  aware  of  the  full 
details  of  the  planned  planes  operation.”375  The  men  learned  how  to  conduct  hijackings  and 
disarm  air  marshals.  Al  Jordani  also  taught  them  how  to  kill  people  with  knives  and  provided 
them  with  a  few  useful  phrases  in  English.  Interestingly,  the  hijackers  were  also  taught  about 
other  types  of  attack  techniques,  including  truck  bombings,  “so  that  they  would  not  be  able  to 
disclose  the  exact  nature  of  the  operation  if  they  were  caught.”376  It  was  not  until  these  men 
arrived  in  the  United  States  that  they  were  told  that  the  planned  attack  involved  flying  airliners 
into  buildings.377 

When  most,  if  not  all,  of  the  hijackers  had  arrived  in  the  United  States,  during  the  summer  of 
2001,  they  began  their  final  planning  for  the  operation.  Three  of  the  pilots — Atta,  Jarrah,  and  al 
Shehhi — conducted  surveillance  trips  in  early  summer,  each  traveling  in  first  class  (probably  to 
better  observe  the  crew)  on  United  Airlines  flights.  Atta  flew  from  Boston  to  San  Francisco  and 
then  on  to  Las  Vegas;  Jarrah  traveled  from  Baltimore  to  Los  Angeles  and  then  on  to  Las  Vegas; 
and  al  Shehhi  went  from  New  York  to  San  Francisco  and  then  to  Las  Vegas.  Each  of  the  three 
flew  on  the  same  type  of  plane  he  would  pilot  on  September  ll.378  In  addition,  all  of  the  men 
continued  to  train  at  local  gyms,  as  they  had  in  previous  months,  and  the  pilots  took  many 
practice  flights  on  small  airplanes.379  At  some  point  in  July,  Hani  Hanjour  rented  a  plane  in  New 
Jersey  and  flew  it  to  Gaithersburg,  Maryland — this  route  likely  would  have  brought  him  in 
proximity  to  Washington,  D.C.380 
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At  some  point,  the  lead  operatives  selected  the  specific  flights  that  would  be  hijacked.  The  men 
were  careful  to  choose  large  Boeing  757  and  767  aircraft  scheduled  to  make  cross-country 
flights — the  amount  of  fuel  on  these  planes  would  maximize  the  incendiary  effect  when  the  pilots 
flew  into  the  designated  targets.  The  men  also  strategically  selected  their  seats  on  the  various 
flights,  based  upon  the  configuration  of  the  specific  aircraft  in  question.  The  arrangement  of  the 
passenger  seats  on  Flights  1 1  and  175  provided  more  maneuverability  for  the  hijackers,  so  on 
those  two  flights,  they  purchased  tickets  in  both  first  class  and  business  class.  On  the  two  other 
flights,  which  were  both  on  Boeing  757  aircraft,  the  single -rowed  seats  provided  less  flexibility, 
and  all  of  the  hijackers  purchased  first-class  tickets,  ensuring  ready  access  to  the  cockpit  on  the 
morning  of  September  ll.381 

Attack 

In  the  early  morning  hours  of  Tuesday,  September  11,  2001,  Mohammed  Atta  and  fellow  hijacker 
Abdul  Aziz  al  Omari  flew  from  Portland,  Maine,  to  Boston,  Massachusetts,  arriving  at  Logan 
Airport  at  approximately  6:45  AM,  where  they  met  their  co-conspirators,  Satam  al  Suqami,  Wail 
al  Shehri,  and  Waleed  al  Shehri.  All  five  men  would  soon  board  American  Airlines  Flight  1 1,  en 
route  to  Los  Angeles  International  Airport.  Meanwhile,  in  another  part  of  Logan  Airport,  at 
Newark  Airport  in  New  Jersey,  and  at  Dulles  Airport  in  Virginia,  the  other  hijackers  were 
meeting,  clearing  security,  and  boarding  their  flights.382 

After  boarding  Flight  1 1 ,  the  five  men  took  their  seats — the  al  Shehri  brothers  in  first  class  and 
Atta,  al  Omari,  and  al  Suqami  in  business  class.  There  were  81  passengers  (including  the 
hijackers)  and  1 1  crew  members  on  board  the  Boeing  767  aircraft.  Shortly  after  8:00  AM,  the  five 
men  took  over  the  flight,  which  had  departed  Logan  Airport  at  7:59  AM  that  morning.  After 
stabbing  at  least  two  of  the  nine  flight  attendants  and  using  mace  to  force  the  first-class 
passengers  toward  the  back  of  the  plane,  the  five  men  commandeered  the  aircraft.  At  8:13  AM, 
the  flight  was  diverted  from  its  course,  after  the  controls  were  taken  over  by  Mohammed  Atta, 
who  was  the  only  one  of  the  five  men  who  knew  how  to  pilot  the  plane.  He  flew  the  plane  toward 
New  York  City,  and  less  than  an  hour  after  the  plane  had  left  Boston,  it  slammed  into  the  North 
Tower  of  the  World  Trade  Center,  at  8:46  AM,  cutting  through  floors  93  to  99.  All  on  board  the 
aircraft  were  killed  instantly,  as  were  several  people  inside  the  building.  Less  than  two  hours 
later,  at  10:28  AM,  the  North  Tower  collapsed,  killing  all  of  those  who  had  survived  the  impact 
on  the  upper  floors  and  killing  several  first  responders.383 

At  8:14  AM.,  United  Airlines  Flight  175,  a  Boeing  767  carrying  56  passengers  (including  five 
hijackers)  and  nine  crew  members,  departed  Logan  Airport,  also  bound  for  Los  Angeles.  Between 
8:42  AM  and  8:46  AM,  five  men — Ahmed  Alghamdi,  Hamza  Alghamdi,  Mohand  Alshehri, 

Fayez  Ahmed  Banihammad,  and  Marwan  al  Shehhi — commandeered  the  aircraft  in  a  manner 
similar  to  the  hijackers  on  Flight  11.  They  used  mace  and  knives  and  killed  both  pilots  in  the 
cockpit,  which  allowed  al  Shehhi,  who  had  received  flight  training,  to  take  the  controls  of  the 
airliner.  He  flew  the  plane  toward  New  York  City,  and  at  9:03  AM,  the  plane  flew  into  the  South 
Tower  of  the  World  Trade  Center,  crashing  through  floors  78  through  84  of  the  building.  The 
aircraft  exploded  into  a  fireball  and  instantly  killed  all  on  board,  as  well  as  several  people  within 
the  tower.  At  9:58  AM,  the  South  Tower  collapsed  in  just  10  seconds,  likely  killing  all  of  those 
who  remained  inside  as  well  as  first  responders  and  civilians  on  the  building’s  concourse  and  at 
the  nearby  Marriott  Hotel.384 
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Just  a  few  minutes  after  Flight  175  took  off  from  Logan  Airport,  American  Airlines  Flight  77 
departed  Dulles  International  Airport  in  Herndon,  Virginia,  at  8:20  AM,  en  route  to  Los  Angeles. 
This  airliner,  a  Boeing  757  aircraft,  had  58  passengers  and  six  crew  members  on  board.  Among 
the  passengers  were  five  hijackers — Hani  Hanjour,  Nawaf  al  Hazmi,  Salem  al  Hazmi,  Khalid  al 
Mihdar,  and  Majed  Moqed — who  subdued  the  passengers,  using  knives  and  box  cutters,  between 
8:51  AM  and  8:54  AM.  It  is  believed  that  Hani  Hanjour,  who  had  received  flight  training,  took 
over  controls  of  the  aircraft.  At  8:55  AM,  the  Boeing  757  began  an  unauthorized  turn  to  the 
southeast,  toward  Washington,  D.C.  At  9:37  AM,  Flight  77  crashed  into  the  newly  renovated 
west  side  of  the  Pentagon,  destroying  four  of  the  building’s  five  rings  on  that  side,  instantly 
killing  all  those  on  board  the  aircraft,  and  killing  125  inside  the  building  and  seriously  injuring 
106  people.385 

At  8:42  AM,  United  Airlines  Flight  93,  a  Boeing  757  aircraft,  departed  Newark  International 
Airport  in  New  Jersey,  en  route  to  San  Francisco.  Among  the  37  passengers  and  seven  crew 
members  on  board  were  four  hijackers — Saeed  Alghamdi,  Ahmed  Alnami,  Ahmad  Ibrahim  al 
Haznawi,  and  Ziad  Samir  Jarrah.  By  9:15  AM,  the  aircraft  reached  its  cruising  altitude  of  35,000 
feet,  and  the  automatic  pilot  was  engaged.  Jarrah,  the  only  one  of  the  four  terrorists  who  had 
received  flight  training,  took  over  controls  of  the  aircraft,  after  at  least  one  passenger  and  possibly 
a  flight  attendant,  the  captain,  and  first  officer  had  been  stabbed  to  death.  Just  before  9:30  AM,  a 
manual  override  was  executed,  and  the  aircraft  gained  an  additional  5,000  feet  in  altitude,  turning 
from  its  westerly  direction  to  the  southeast.  Then  the  aircraft  descended,  and  passengers  were 
herded  to  the  rear  of  the  plane,  where  several  of  them  made  phone  calls  to  their  family  members, 
friends,  and  colleagues.  In  the  course  of  these  calls,  information  was  exchanged  about  the  attacks 
on  the  World  Trade  Center,  and  at  least  five  passengers  on  Flight  93  made  reference  to  their 
intent  to  revolt  against  the  hijackers  in  an  attempt  to  take  over  the  plane.  At  9:57  AM,  the 
passengers  began  their  assault,  and  in  response,  Jarrah  began  rolling  it  from  right  to  left  and  back 
again,  in  a  clear  attempt  to  cause  the  passengers  to  lose  their  footing.  The  offensive  continued, 
and  at  10:02  AM,  having  judged  that  “the  passengers  were  only  seconds  from  overcoming  them,” 
the  hijackers  decided  to  crash  the  aircraft.386  Only  20  minutes  (by  air)  away  from  Washington, 
D.C.,  Flight  93  hurtled  at  580  miles  per  hour  into  a  field  in  Shanksville,  Pennsylvania,  instantly 
killing  all  those  aboard  the  aircraft.387 

Consequences 

Approximately  2,970  people  were  killed  in  the  coordinated  attacks,  and  more  than  2,000  were 
injured.388  Structural  damage  was  considerable.  When  American  Airlines  Flight  1 1  slammed  into 
the  North  Tower  of  the  World  Trade  Center,  the  aircraft  cut  through  floors  93  to  99,  likely 
making  all  three  of  the  building’s  stairwells  impassable.  On  impact,  the  airliner  exploded,  and  a 
fireball  traveled  down  an  elevator  shaft,  causing  subsequent  explosions  on  several  floors  of  the 
North  Tower,  including  those  below  ground  level.  Both  the  North  and  South  Towers  were 
engulfed  in  thick  black  smoke,  fed  by  burning  jet  fuel  from  Flight  1 1.  At  10:28  AM  the  North 
Tower  collapsed,  having  been  severely  weakened  by  the  impact  of  the  aircraft  and  subsequent 
fire.389 

When  United  Airlines  Flight  175  flew  into  the  South  Tower  of  the  World  Trade  Center  at  9:03 
AM,  it  hit  floors  78  through  84.  However,  the  plane  banked  as  it  approached  the  building, 
meaning  that  some  portions  of  the  impacted  floors  were  not  damaged  and  at  least  one  of  the 
stairwells  remained  passable  from  the  91st  to  ground  level.  The  initial  impact  damaged  the  South 
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Tower  extensively.  Just  45  minutes  after  Flight  175  slammed  into  the  building,  it  collapsed  upon 
itself,  creating  a  huge  windstorm  and  rocking  the  still  standing  North  Tower,  knocking  several 
people  inside  the  building  to  the  floor.190 

In  a  report  published  four  years  after  the  September  1 1  attacks,  the  National  Institute  of  Standards 
&  Technology  concluded  that  a  number  of  factors  led  to  the  collapse  of  the  North  and  South 
Towers  of  the  World  Trade  Center.  These  included:  damage  to  the  structures  of  the  buildings 
from  the  initial  aircraft  impact;  jet  fuel  sprayed  into  the  buildings  that  ignited  fires  on  several 
floors;  dislodging  of  fireproofing  insulation  from  the  steel  structure  of  both  buildings,  enabling 
unprotected  steel  to  heat  rapidly;  weakened  core  columns  that  increased  the  weight  on  external 
columns;  and  bowed  perimeter  columns  that  had  less  ability  to  carry  loads  than  they  would  have 
under  normal  circumstances.191 

When  American  Airlines  Flight  77  crashed  into  the  west  side  of  the  Pentagon,  four  of  the 
building’s  five  rings  were  heavily  damaged  on  that  side.  The  Pentagon  was  just  five  days  away 
from  completing  renovation  of  this  part  of  the  building — the  first  phase  of  a  $250  million  project 
to  bring  the  building  up  to  current  standards.192  Pentagon  officials  commented  that  lives  may  have 
been  saved  because  the  plane  impacted  this  renovated  area  rather  than  parts  of  the  building  that 
had  not  yet  been  refurbished.  Some  of  the  offices  in  this  part  of  the  building  were  not  yet 
occupied  on  September  11,  and  those  that  were  recently  occupied  had  been  fitted  with  blast- 
resistant  windows,  which  may  have  lessened  the  impact  of  the  explosion.191 

There  was  short-term  system  disruption  following  the  attacks  on  the  World  Trade  Center  and 
Pentagon.  All  non-emergency  civilian  aircraft  in  the  United  States  were  grounded,  and  thousands 
of  passengers  across  the  country  and  in  Canada  were  stranded.  These  airliners  remained  on  the 
ground  for  three  days.  There  was  extensive  media  coverage  of  the  event,  both  domestically  and 
internationally,  in  newspapers  and  magazines  and  on  radio  stations  and  television  channels.  The 
targets  of  this  attack  were  symbolic:  the  World  Trade  Center  represented  the  financial  and 
economic  power  of  the  United  States,  while  the  Pentagon  represented  the  strength  of  both  the 
government  and  the  military.194 

The  attack  caused  high  stress  and  other  psychological  symptoms  in  those  who  were  at  the  target 
sites  and  those  who  witnessed  the  events  on  television  and  through  other  media.  In  addition  to 
long-term  emotional  health  issues,  the  attacks  of  September  1 1  have  had  a  lasting  effect  on  the 
physical  health  of  those  who  were  at  the  World  Trade  Center  on  the  day  of  the  attack  and  on  the 
workers  who  combed  through  the  wreckage  of  the  buildings  in  the  weeks  after  the  events  of  that 
day.  The  cloud  of  smoke  and  dust  that  covered  Lower  Manhattan  as  the  North  and  South  Towers 
collapsed  contained  contaminants,  including  asbestos,  benzene,  mercury,  and  lead.  These 
substances,  some  of  which  are  carcinogenic,  also  can  cause  respiratory,  heart,  liver,  kidney,  and 
nervous  system  damage.  A  study  conducted  by  Mount  Sinai  Hospital,  the  results  of  which  were 
released  in  September  2006,  revealed  that  70%  of  10,000  “Ground  Zero”  workers  have 
experienced  new  or  worsened  respiratory  problems  since  September  11,  2001. 195 

The  economic  impact  of  these  attacks  can  also  be  considered  high,  especially  compared  to  the 
relatively  small  amount  of  money — $400,000  to  $500,000 — that  al  Qaeda  used  to  finance  the 
attacks.196  Estimates  vary  depending  on  the  parameters  used,  but  the  costs  of  the  9/11  attacks 
were  in  the  billions  of  dollars.  The  Government  Accountability  Office  prepared  a  report  that 
summarized  the  findings  of  several  government  and  private  studies,  and  found  that  estimates  of 
direct  and  indirect  costs  of  the  World  Trade  Center  attack  alone  ranged  between  $83  billion  and 
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$105  billion.197  Direct  costs  included  destruction  of  life  and  property  and  the  financial  burden  of 
clean-up  efforts.  Indirect  costs  to  the  economy  included  loss  of  income  from  business  closings  as 
well  as  the  resultant  unemployment.  In  addition,  the  United  States  has  had  to  bear  the  brunt  of 
increased  security  costs,  such  as  expenses  associated  with  new  screening  technologies  at 
airports.398 

The  September  1 1  attacks  influenced  U.S.  policy,  resulting  both  in  the  creation  of  a  new 
government  agency,  the  Department  of  Homeland  Security,  and  in  the  commencement  of  military 
operations  against  the  Taliban  and  al  Qaeda  strongholds  in  Afghanistan.  In  addition,  the 
consequences  of  the  attack  reveal  examples  of  security  service  learning,  as  demonstrated  by 
changed  security  screening  procedures  at  airports  and  the  strengthening  of  cockpit  doors  aboard 
aircraft. 

Factors  Associated  With  Success  or  Failure 

An  examination  of  this  incident  reveals  that  several  factors  influenced  its  outcome. 

Training :  Prior  to  the  attack,  some  of  the  terrorists  had  received  training  at  al  Qaeda  camps  in 
Afghanistan,  and  at  least  four  of  the  hijackers  had  learned  how  to  pilot  commercial  aircraft  and 
had  FAA  certificates  as  qualified  pilots.399  Information  suggests  that  Khalid  Sheikh  Mohammed 
may  have  provided  some  of  the  hijackers  with  lessons  on  Western  culture  and  travel.400  However, 
a  few  of  the  terrorists — notably  Nawaf  al  Hazmi  and  Khalid  al  Mihdhar — were  not  prepared  for 
life  in  the  United  States.  Neither  man  spoke  much,  if  any,  English,  and  they  were  unfamiliar  with 
Western  culture.401  At  the  same  time,  both  were  able  successfully  to  play  their  roles  in  the  attacks 
on  September  11.  Furthermore,  they  were  experienced  fighters — both  had  fought  in  Bosnia  in 
1995  and  had  visited  Afghanistan  many  times  for  instruction.402  The  training  of  the  19  hijackers 
was  sufficient  for  this  operation. 

Technical  sophistication :  This  plan  did  not  require  the  fabrication  of  weapons  or  other 
technologically  advanced  techniques.  It  was  a  complex  plot  that  required  a  great  deal  of  planning 
and  coordination,  but  the  weapons  and  means  to  be  used  were  relatively  simple. 

Operational  proficiency.  To  use  the  aircraft  as  weapons,  four  of  the  terrorists  were  required  to 
complete  training  and  be  licensed  to  fly  commercial  airliners.  On  the  day  of  the  attack,  the 
hijacker  pilots  had  to  precisely  guide  the  aircraft  to  the  designated  targets,  requiring  a  high  level 
of  operational  proficiency.  The  muscle  hijackers  were  proficient  in  their  role  of  subduing  the 
passengers  and  crew;  only  on  Flight  93  did  the  muscle  hijackers  fail  in  their  task  of  preventing 
interference  with  the  terrorist  pilots. 

Terrorist  profile  indicators'.  Although  some  of  the  hijackers  were  known  for  their  extremist  views 
in  the  mid-1990s,  after  they  became  involved  in  the  planning  for  the  September  1 1  operation, 
they  made  more  of  an  effort  to  blend  into  their  surroundings.  As  mentioned  earlier,  once 
Mohammed  Atta,  Marwan  al  Shehhi,  and  Ziad  Jarrah  returned  to  Germany  after  their  training  in 
Afghanistan,  they  distanced  themselves  from  known  extremists,  shaved  their  beards,  and  dressed 
in  Western-style  clothing.  Atta,  considered  the  ringleader  of  the  plot,  was  “a  near  perfect  person” 
to  carry  out  the  operation,  having  no  record  of  terrorist  activities  and  speaking  fluent  English.403 
In  contrast,  at  least  two  of  the  hijackers,  Khalid  al  Mihdhar  and  Nawaf  al  Hazmi,  had  come  to  the 
attention  of  the  National  Security  Agency  (NSA)  before  September  11,  2001.  By  early  1999,  the 
NSA  had  identified  al  Hazmi  as  an  al  Qaeda  associate,  and  a  year  later,  al  Hazmi  and  al  Mihdhar 
were  “in  the  sights”  of  NSA  personnel;  while  this  information  was  shared  with  the  U.S. 
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intelligence  community,  it  does  not  appear  to  have  been  shared  with  those  at  U.S.  consulates  or  at 
the  U.S.  border.404 

Terrorist  OPSEC :  The  operational  security  for  this  incident  can  be  considered  good.  According  to 
Khalid  Sheikh  Mohammed,  “only  a  handful  of  al  Qaeda  operatives”  knew  all  of  the  details  of  the 
plot.405  Further,  once  inside  the  United  States,  the  terrorists  made  no  contact  with  al  Qaeda 
sympathizers  within  the  country,  so  as  not  to  disclose  their  presence.406  They  used  pre-paid 
calling  cards  and  publicly  accessible  Internet  connections  so  that  their  communications  would  not 
be  intercepted  by  the  U.S.  intelligence  community  or  law  enforcement  personnel.  According  to  a 
former  FBI  official,  the  1 9  men  “operated  flawlessly  in  their  planning  [and]  communications”  in 
preparation  for  the  attacks.407 

Innovation :  The  method  of  this  attack  was  highly  innovative.  While  it  was  not  the  first  time  that 
terrorists  had  considered  flying  planes  into  buildings — in  both  the  Air  France  hijacking  by  the 
Armed  Islamic  Group  in  1994  and  Operation  Bojinka  in  1995,  those  involved  considered  using 
airplanes  as  weapons — the  attacks  of  September  1 1  mark  the  first  time  that  terrorists  were 
successful  at  executing  the  entire  scheme  to  crash  airliners  into  buildings  in  simultaneous 
operations.  In  addition,  using  aircraft  themselves  as  weapons  helped  to  ensure  that  the  cost  of  the 
entire  operation  was  relatively  small.  The  majority  of  expenses  associated  with  the  plot  came 
from  living  expenses,  travel  by  the  hijackers  in  the  months  prior  to  September  2001,  and  fees 
associated  with  flight  training.  Since  the  terrorists  had  no  need  to  transfer  large  sums  of  money, 
“nothing  they  did  would  have  led  the  banks  to  suspect  criminal  behavior,  let  alone  a  terrorist  plot 
to  commit  mass  murder.”408  The  innovative  nature  of  the  attack  thus  contributed  to  the 
operational  security  of  the  plot,  allowing  the  terrorists  to  move  forward  with  their  plans  and 
remain  undetected. 

Law  enforcement  or  intelligence  knowledge :  In  the  months  leading  up  to  the  attack,  U.S.  law 
enforcement  and  intelligence  agencies  were  aware  of  al  Qaeda’s  desire  to  attack  American 
targets,  given  its  history  of  previous  operations,  such  as  the  bombing  of  the  U.S.  embassies  in 
Kenya  and  Tanzania  in  August  1998  and  the  suicide  attack  on  the  USS  Cole  in  October  2000.  By 
late  July  2001,  U.S.  intelligence  agencies  were  receiving  the  “greatest  volume  of  threat  reporting 
since  the  Millennium  plot,”  although  the  reports  hinted  at  “multiple,  possibly  catastrophic 
terrorist  attacks  being  planned  against  American  interests  overseas,”  rather  than  at  home.409  Much 
of  the  intelligence  reporting  about  al  Qaeda  at  that  time  was  related  to  earlier  terrorist  attacks  by 
the  group  rather  than  to  the  future  threat  of  an  event  such  as  the  September  1 1  attacks.410 

Law  enforcement  and  intelligence  entities  were  hindered  by  the  nature  of  al  Qaeda.  The  threat 
posed  by  the  group  was  quite  different  from  the  earlier  danger  of  the  Cold  War-era  Soviet  Union, 
and  “the  large,  unwieldy  U.S.  government  tended  to  underestimate  [the  threat  of  al  Qaeda]  that 
grew  ever  larger.”411  Aviation  security  experts  and  intelligence  personnel  appeared  to  have  a 
difficult  time  imagining  or  believing  that  terrorists  would  fly  airplanes  into  buildings,  although 
some  within  the  Federal  Aviation  Administration  and  other  government  agencies  had  considered 
the  possibility  of  terrorist  suicide  hijackings  or  traditional  hijackings  in  the  late  1990s.412  Some  of 
the  attacks  preceding  those  of  September  1 1 — notably  the  first  attack  on  the  World  Trade  Center, 
the  bombing  at  the  Alfred  P.  Murrah  Building  in  Oklahoma  City,  and  the  nearly  simultaneous 
bomb  blasts  at  the  U.S.  embassies  in  Kenya  and  Tanzania — had  used  explosives  packed  in 
vehicles,  and  this  may  have  influenced  thinking  about  future  threats.413 
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In  early  2001,  the  Director  of  Central  Intelligence,  George  Tenet,  appointed  a  senior  manager  to 
develop  strategic  assessments  on  al  Qaeda  and  its  capabilities.  To  this  end,  the  Counterterrorist 
Center  at  the  CIA  created  a  strategic  assessments  division  during  the  summer  of  2001.  The  head 
of  this  new  branch  arrived  on  the  job  on  September  10,  2001. 414 

Now  that  the  innovative,  transnational  nature  of  the  threat  is  apparent,  Western  security  services 
should  pay  attention  to  the  types  of  indicators  that  were  present  before  this  attack.  For  example, 
Atta,  al  Shehhi  and  Jarrah  were  all  studying  in  Germany,  yet  traveled  to  Afghanistan  and 
eventually  the  U.S.  While  overseas  travel  is  not  by  itself  a  suspicious  act,  travel  to  countries 
known  to  harbor  terrorist  training  or  command  elements  is  worthy  of  attention,  particularly  if 
there  is  no  obvious  reason  for  such  travel  (family,  business)  and  the  travelers  move  on  to  potential 
target  countries.  Wire  transfers  are  also  common,  but  if  small  transfers  accumulate  into  large 
sums,  this  could  indicate  the  bankrolling  of  a  major  operation.  In  the  case  of  the  9/1 1  plotters,  the 
purchase  of  $50,000  in  travelers’  checks  could  have  been  viewed  as  an  indicator  of  criminal 
activity  at  the  very  least;  authorities  should  be  vigilant  for  such  activity  in  the  future.  Another 
potential  indicator  is  unusual  interest  in  specialized  training.  Security  services  must  keep  in  mind 
that  terrorist  groups  are  adaptive  and  innovative,  and  such  activity  may  foreshadow  a  new  tactic 
that  will  be  employed. 

Security  environment.  While  there  were  certainly  security  measures  in  place  in  the  United  States 
during  the  preparation  for  and  execution  of  the  attacks,  the  hijackers  were  able  to  exploit 
loopholes  in  the  system  to  their  advantage,  and  their  plans  were  not  negatively  impacted  by  the 
security  environment  in  the  United  States.  None  of  the  hijackers  tried  to  bypass  legal  entry 
procedures  to  enter  the  United  States,  but  they  did  take  advantage  of  these  procedures.415  The 
majority  of  the  hijackers  arrived  in  the  U.S.  with  Saudi  passports,  and  at  this  time,  Saudi  citizens 
rarely  overstayed  their  visas.  Based  on  this  information,  consular  officials  felt  they  had  little 
reason  to  fear  granting  visas  to  the  future  hijackers.416 

One  component  of  the  security  system  in  place  on  the  day  of  the  attack  was  known  as  the 
Computer-Assisted  Passenger  Prescreening  System  (CAPPS).  This  program  was  designed  to 
identify  passengers  who  would  be  most  likely  to  require  additional  security  screening  prior  to 
boarding  an  aircraft.  FAA  rules  required  that  the  checked  baggage  of  CAPPS-designated 
passengers  be  screened  for  explosives.  Seven  of  the  19  hijackers  were  identified  for  additional 
security  screening  as  a  result  of  this  prescreening  program.  However,  there  were  no  consequences 
of  this  selection — four  of  the  hijackers  had  no  checked  baggage  with  them,  and  although  the  bags 
of  the  other  three  were  screened,  they  were  carrying  no  explosives.  All  of  the  men  were  cleared  to 
board  their  flights,  having  “defeated  all  of  the  pre-boarding  defense  layers  the  U.S.  civil  aviation 
security  system  mounted  on  September  11,  200 1.”417 

Effective  information  sharing  and  international  cooperation:  There  was  a  lack  of  effective 
information  sharing  and  international  cooperation  in  relation  to  the  threat  posed  by  al  Qaeda  prior 
to  the  attacks  of  September  11,  2001.  Members  of  the  9/11  Commission,  after  extensive 
investigation,  found  that  “information  was  not  shared,  sometimes  inadvertently  or  because  of 
legal  misunderstandings,”  and  often,  the  analysis  generated  from  this  information  was  not 
pooled.418  Former  Central  Intelligence  Agency  Director  George  Tenet  admitted  that  throughout 
the  U.S.  government,  there  had  been  no  capability  to  “integrate  foreign  and  domestic  knowledge, 
data  operations,  and  analysis.”419  Even  if  there  had  been  sufficient  warning  prior  to  the  attack, 
there  was  no  effective  dissemination  mechanism  to  “put  [the  warnings]  into  action.”  Had  such  a 
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mechanism  existed,  this  might  have  provided  the  means  for  interdicting  the  plot  in  its  planning 
phases.  However,  many  factors,  including  the  innovative  nature  of  the  operation  (See  Innovation), 
complicated  the  possibility  of  preventing  the  terrorists’  plans  from  going  forward. 

Obsen’ant  public  and/or  vigilant  security  services:  Although  a  few  of  the  men  acted  in  ways  that 
made  neighbors  suspect  their  intentions,  most  of  the  future  hijackers  blended  in  enough  to  the 
surrounding  population  that  they  did  make  the  public  or  local  police  suspicious.  More  recent 
events,  such  as  the  failed  plot  to  bring  down  U.S.  airliners  with  liquid  explosives  in  August  2006, 
have  been  foiled  because  of  public  sensitivity  to  suspicious  behavior.  However,  during  the 
summer  of  2001,  the  idea  of  a  major  terrorist  operation  on  U.S.  soil  seemed  highly  unlikely,  and 
there  was  less  likelihood  that  citizens  would  consider  any  sort  of  behavior  to  be  indicative  of 
terrorism. 

Finally,  the  initiative  of  the  passengers  on  Flight  93  should  be  taken  into  account  when  examining 
the  factors  underlying  this  attack.  The  flight  departed  Newark  International  Airport  40  minutes 
late,  due  to  heavy  air  traffic  that  morning.420  Consequently,  by  the  time  the  flight  was  hijacked,  or 
shortly  thereafter,  at  least  some  of  the  passengers  were  aware  of  the  attacks  on  the  World  Trade 
Center  and  the  Pentagon.  Surmising  that  their  aircraft  also  might  be  used  as  a  weapon,  some  of 
the  passengers  resolved  to  overtake  the  hijackers,  and  in  so  doing,  prevented  the  plane  from 
targeting  either  the  White  House  or  the  U.S.  Capitol  Building. 

Findings 

Many  factors  led  to  the  success  of  this  plot.  While  no  single  factor  seems  to  stand  out  as  having 
been  the  most  important  contributor  to  the  success  of  this  plot,  one  aspect  that  appears  critical 
was  the  innovative  method  of  the  attack.  Although  terrorists,  including  those  affiliated  with  al 
Qaeda,  had  considered  this  type  of  operation,  it  had  never  been  used  in  practice.  Further,  al 
Qaeda’s  earlier  attacks,  while  often  directed  against  American  targets,  had  all  occurred  abroad. 
The  September  1 1  attacks  were  thus  something  of  a  departure  from  al  Qaeda’s  earlier  behavior 
and  caught  Americans  by  surprise. 

The  good  operational  security  that  characterized  this  plot  also  was  crucial  to  its  success.  Very  few 
people  knew  the  full  details  of  the  operation,  and  those  who  were  aware  of  the  specifics  did  not 
share  the  information.  Further,  the  terrorists  were  careful  with  their  financial  transactions, 
ensuring  that  they  would  not  come  to  the  attention  of  hank  authorities.  The  men  were  also 
cautious  with  their  communications,  using  phones  and  Internet  connections  that  would  be 
difficult  to  trace  back  to  them  or  their  affiliates. 

The  planning  and  training  for  this  plot  were  thorough,  and  this  also  contributed  to  success.  Once 
the  operatives  were  selected,  those  who  would  fly  the  planes  went  through  hours  of  flight  training 
to  ensure  that  they  would  be  able  to  get  the  planes  to  the  desired  targets  on  the  day  of  the  attack. 
The  men  who  would  be  responsible  for  subduing  the  passengers  trained  at  the  gym  regularly  and 
were  educated  in  the  techniques  required  for  hijacking  an  aircraft. 

All  of  these  factors  were  critical  in  the  terrorists’  success,  and  the  impact  of  this  success  is  still 
felt  today.  The  attacks  led  to  heightened  security  measures  at  airports,  led  to  the  creation  of  the 
Department  of  Homeland  Security,  increased  intelligence  spending,  and  continue  to  play  a  role  in 
the  psyche  of  Americans. 
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The  Liquid  Explosives  Airline  Plot  in 
the  United  Kingdom — August  2006 

Overview 

In  August  2006,  British  authorities  announced  that  they  had  arrested  more  than  20  men  who  were 
planning  to  launch  an  attack  on  American  airliners  traveling  from  the  United  Kingdom  to  the 

United  States.  In  close  cooperation  with  international  partners, 
notably  those  in  the  United  States  and  Pakistan,  British 
officials  had  tracked  the  members  of  this  cell  for  several 
months.  In  the  early  hours  of  a  Thursday  morning  in  August, 
they  launched  a  raid,  taking  the  men  into  custody  and  averting 
a  potentially  catastrophic  terrorist  attack  that  might  have 
resulted  in  the  deaths  of  thousands  of  innocent  people. 

Significance  of  the  Incident 

As  demonstrated  by  the  Air  France  hijacking  in  1994,  the  Bojinka  plot  of  1995,  and  the  events  of 
September  11,  2001,  terrorist  groups  have  the  desire  and  ability  to  attack  the  aviation  sector. 

When  violent  incidents  against  airliners  succeed,  the  groups  involved  generally  experience  great 
benefit  at  low  cost. 

This  plot  is  significant  because  it  targeted  the  U.S.  airline  system  and  appeared  to  be  well 
developed  and  possibly  near  the  execution  phase.  Further,  this  incident  once  again  shows  the 
potential  capability  of  homegrown  terrorists,  such  as  those  who  perpetrated  the  London  subway 
attacks  of  July  2005,  to  wreak  havoc  within  Western  countries.  This  thwarted  operation  may  also 
show  the  ability  of  today’s  terrorists  to  learn  from  those  who  have  carried  out  attacks  in  the  past. 

This  incident  does  not  mark  the  first  time  that  attackers  intended  to  use  liquid  explosives,  and  it  is 
possible  that  the  men  involved  in  this  plot  learned  from  these  earlier  incidents.  Over  the  past  10 
years,  triacetone  triperoxide  (TATP)  and  other  peroxide-based  explosives  have  been  used  in  a 
number  of  actual  (and  attempted)  terrorist  operations.  TATP  became  popular  as  the  weapon  of 
choice  for  Palestinian  suicide  bombers. 

In  at  least  two  cases,  attackers  attempted  to  use  liquid  explosives  in  operations  that  did  not  go 
according  to  plan.  Ahmed  Ressam,  who  intended  to  detonate  a  bomb  at  the  Los  Angeles  airport  as 
part  of  a  series  of  Millennium  attacks,  was  arrested  after  an  observant  security  guard  found  liquid 
explosives  in  the  trunk  of  his  car.  Two  years  later,  the  so-called  “shoe  bomber,”  Richard  Reid, 
tried  to  detonate  an  explosive  using  TATP  as  the  initiator,  but  was  unsuccessful.  More  recently, 
the  bombers  who  successfully  carried  out  simultaneous  attacks  on  the  London  subway  system  in 
July  2005  used  peroxide-based  explosives  concealed  in  their  backpacks.421  (See  the  case  study  on 
this  attack  in  the  previous  section.) 

Nor  does  this  plot  mark  the  first  time  that  attackers  planned  to  detonate  explosives  simultaneously 
on  multiple  American  airplanes  while  in  mid-flight.  (See  the  case  study  in  this  section  for  a 
detailed  explanation  of  Operation  Bojinka.)  Similarities  between  Operation  Bojinka  and  this  plot 
are  the  use  of  liquid-based  explosives  concealed  in  seemingly  innocuous  containers  and  the  fact 
that  both  plots  failed.  However,  while  Yousef  planned  to  use  timed  explosives,  it  appears  that  the 


Type  of  Attack:  Planned 
detonation  of  liquid  explosives 
aboard  multiple  airliners  while  in 
flight 

Date:  As  early  as  August  2006 
Group  Type:  Radicalized  British 
citizens  with  ties  to  Pakistan 
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British  plot  involved  the  use  of  suicide  bombers.  In  addition,  the  liquid  explosives  in  this  plot 
might  have  required  mixing  once  the  attackers  were  on  board  the  planes,  whereas  the  explosives 
to  be  used  in  Operation  Bojinka  did  not.  The  Bojinka  plot  heightened  the  sensitivity  of  security 
services  to  liquid  explosives,  but  over  time,  this  sensitivity  decreased  as  other  tactics  emerged.  It 
was  not  until  August  2006,  when  a  group  of  young  men  in  England  were  arrested  on  suspicion  of 
plotting  this  terrorist  attack,  that  the  threat  associated  with  liquid  explosives  once  again  grabbed 
the  attention  of  both  the  authorities  and  the  general  public.422 

Description  of  the  Group  or  Individuals  Involved 

The  suspects  ranged  in  age  from  17  to  35.  All  but  one  of  the  suspects  lived  in  England,  either  in 
Birmingham,  located  in  the  Midlands;  High  Wycombe,  to  the  west  of  London;  or  within  walking 
distance  of  one  another  in  or  near  the  Walthamstow  district  of  East  London.  Rashid  Rauf,  the 
only  plotter  who  lived  outside  the  United  Kingdom,  made  his  home  in  Bahawalpur,  a  town  in 
southern  Pakistan,  having  moved  there  from  Birmingham  in  2002. 42  5 

Other  than  their  British  citizenship,  there  were  few  unifying  features  among  the  plotters.  While  all 
of  the  men  were  Muslim,  a  few  were  recent  converts  to  the  religion,  whereas  others  were  lifelong 
adherents  to  the  Islamic  faith.  Some  of  the  men  were  husbands  with  small  children,  while  others 
were  university  students  living  with  their  parents.  Many  were  employed  in  seemingly  ordinary 
work — among  those  arrested  were  a  bakery  deliveryman,  a  hospital  administrator,  and  a  toy-store 
clerk.  One  of  the  apprehended  men  was  a  Heathrow  Airport  security  guard,  who  may  have 
exploited  his  insider  access,  which  is  one  of  the  vulnerabilities  of  the  commercial  aviation 

.  424 

sector. 

In  many  cases,  the  families  and  neighbors  of  those  arrested  on  August  10  had  noticed  nothing 
unusual  in  the  behavior  of  the  suspects  and  were  shocked  when  the  men  were  arrested.  According 
to  the  father  of  brothers  Mehran,  Nabeel,  and  Umair  Hussain — all  three  of  whom  were  taken  into 
custody — the  young  men  were  nothing  more  than  innocent  students.425  Like  Umair  Hussain, 
suspect  Waheed  Zaman,  22  years  old,  was  enrolled  at  London  Metropolitan  University  and  was 
described  by  a  friend  as  a  “nice  fellow”  who  would  “never  hurt  a  fly.”426  His  sister  called  him  a 
“very  normal  boy,”  and  classmates  said  that  he  had  called  for  peace  and  Muslim  integration  with 
Westerners.427  Similarly,  Abdul  Waheed  (formerly  known  as  Don  Stewart- Whyte)  appeared 
rather  unremarkable  to  those  around  him — a  local  imam  called  this  convert  to  Islam  “harmless,” 
saying  that  he  would  never  hurt  anyone.428 

However,  while  those  who  knew  the  plotters  best  may  have  seen  little  reason  to  guess  that  they 
were  in  the  midst  of  planning  for  a  terrorist  attack,  after  the  arrests,  some  neighbors  commented 
on  changes  they  had  noticed  in  the  men  in  recent  months.  In  the  weeks  leading  up  to  August 
2006,  Tayib  Rauf,  a  brother  of  the  suspect  arrested  in  Pakistan,  had  taken  time  away  from  his 
work  as  a  bakery  deliveryman  to  attend  an  intense  Islamic  course  in  Bury,  Lancashire,  located 
approximately  100  miles  from  his  home.429  A  former  classmate  of  Nabeel  Hussain  indicated  that 
he  had  recently  become  stricter  in  his  religious  practices,  had  started  attending  anti-war  rallies  in 
Birmingham  and  Manchester,  and  had  been  barred  from  using  the  Internet  at  school  because 
administrators  had  discovered  that  he  had  been  visiting  a  terrorist  website.430  According  to  a 
neighbor,  another  plotter,  Tanvir  Hussain,  had  become  increasingly  angry  over  British  policies 
toward  Israel,  Afghanistan,  and  Iraq  and  recently  had  been  traveling  from  London  to  High 
Wycombe  to  visit  some  new  friends  there.431  Osman  Adam  Khatib,  who  lived  in  Walthamstow, 
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had  become  more  devoted  to  Islam  within  the  past  year.  He,  like  Hussain,  had  started  spending 
time  with  a  new  set  of  friends,  and  because  his  parents  would  not  allow  this  group  of 
acquaintances  inside  the  family  home,  Khatib  visited  with  them  outside.432 

Motivation 

On  August  9,  two  of  the  plotters  met  at  a  second-floor  apartment  on  Forest  Road  in 
Walthamstow.  They  set  up  a  video  camera,  pressed  “record,”  delivered  their  indictments  of  the 
United  Kingdom  and  the  United  States,  and  explained  why  they  were  determined  to  die  to  bring 
destruction  to  both  countries.  The  information  gleaned  from  the  recordings  provides  ideas  about 
the  plotters’  motivations  for  their  planned  attack.433 

According  to  these  men,  their  planned  suicide  operation  was  aimed  at  taking  revenge  against  the 
United  States  and  its  “accomplices,”  namely  the  United  Kingdom  and  Israel.  As  one  of  the  young 
men  said,  presumably  speaking  to  the  United  States  and  its  allies,  “as  you  bomb,  you  will  be 
bombed  [and]  as  you  kill,  you  will  be  killed.”434  Reciting  from  the  Koran  as  he  sat  in  front  of  the 
video  camera,  he  then  encouraged  others  to  join  jihad.  He  rationalized  killing  American  civilians 
and  their  allies  by  saying  that  they  supported  war  against  Muslims  “through  their  tax  dollars”  and 
were  “too  busy  enjoying  their  Western  lifestyles”  to  speak  out  against  American  foreign  policy.435 

At  least  one  other  suspect  also  saw  U.S.  policy  as  a  justification  for  action,  saying  that  the 
ongoing  fighting  against  Muslims  in  Afghanistan  and  Iraq  had  motivated  him  to  act.  This 
sentiment  was  likely  shared  by  others  involved  in  the  plot.436 

While  the  group  of  British  men  may  have  received  ideological  inspiration  from  al  Qaeda,  any 
deeper  connection  between  al  Qaeda  and  the  plotters  remains  uncertain.  One  of  the  men  who 
recorded  the  August  9  video  is  said  to  have  taken  his  “as  you  kill,  you  will  be  killed”  statement 
directly  from  a  November  2002  fatwa  released  by  bin  Laden.437 

Planning 

Using  a  peroxide-based  solution  disguised  in  sports  drink  bottles  packed  in  hand  baggage,  the 
suspects  supposedly  planned  to  board  transatlantic  American  flights  and  detonate  bombs  once  the 
planes  were  over  the  ocean,  or,  according  to  some  accounts,  over  major  U.S.  cities.  Their  hope 
was  that  this  type  of  explosive  would  escape  the  scrutiny  of  airport  security  screeners  and  would 
enable  the  men  to  capitalize  on  the  various  means  of  attacking  aircraft  available  to  terrorists 
planning  operations  against  commercial  airliners.438  The  attackers,  thought  to  be  at  least  eight  of 
those  arrested,  intended  to  leave  the  top  of  each  sports  drink  bottle  sealed  and  filled  with 
Lucozade  (similar  to  Gatorade),  but  add  a  false  bottom,  packed  with  a  liquid  or  gel  explosive 
dyed  red,  to  match  the  color  of  the  sports  drink.  If  the  suspects  were  confronted,  they  would  be 
able  to  drink  from  the  top  part  of  the  bottle  without  any  ill  effects.  Initially,  authorities  suggested 
that  the  suspects  planned  to  bomb  as  many  as  10  planes,  either  simultaneously  or  over  a  few 
hours,  bombing  three  or  four  each  hour.  However,  British  authorities  subsequently  said  that  these 
early  accounts  were  exaggerated  and  speculative,  indicating  that  the  number  of  planes  the 
suspects  intended  to  attack  was  lower  than  the  initial  reports  indicated.439 

When  the  news  of  the  plot  was  first  reported,  some  U.S.  authorities  hinted  that  a  dry  run  of  the 
attack  was  to  occur  within  two  days,  followed  by  the  actual  operation  a  few  days  after  that. 
Evidence  collected  by  the  authorities  indicates  that  some  of  those  arrested  had  been  visiting  the 
websites  of  various  American  carriers  to  obtain  schedules  for  travel  from  the  United  Kingdom  to 
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the  United  States  on  flights  that  departed  at  similar  times.  Possible  targets  included  American 
Airlines,  Continental  Airlines,  and  United  Airlines  flights  originating  at  Gatwick  and  Heathrow 
airports  in  London  and  traveling  to  airports  in  New  York,  Chicago,  Los  Angeles,  San  Francisco, 
Miami,  and  Washington,  D.C. — from  the  heart  of  England  to  the  centers  of  American  economic, 
cultural,  and  political  power.440 

However,  subsequent  reporting  revealed  that  the  plotters  had  not  yet  decided  which  flights  to 
attack.  In  fact,  the  men  had  not  yet  purchased  airline  tickets,  and  at  least  two  of  the  suspects  had 
yet  to  obtain  passports.  While  they  had  requested  accelerated  approval  for  their  passport 
applications,  they  would  not  have  been  able  to  travel  to  the  United  States  at  the  time  they  were 
taken  into  custody.  Furthermore,  while  initial  reports  suggested  that  the  suspects  had  prepared  the 
explosives  for  the  attack,  more  recent  information  indicates  that  this  was  not  the  case.  Although 
the  men  had  obtained  some  of  the  materials  necessary  for  creating  the  explosives,  they  had  not 
yet  prepared,  mixed,  or  tested  those  materials.441 

Attack 

Authorities  first  became  aware  of  the  activities  of  the  alleged  plotters  shortly  after  the  London 
transit  bombings  in  July  2005.  At  that  time,  some  of  the  residents  of  Walthamstow — where  nine 
of  the  suspects  would  later  be  arrested — alerted  police  officers  about  the  intentions  of  a  “small 
group  of  angry  young  Muslim  men.”442 

By  December  2005,  several  suspects  in  Walthamstow  and  Birmingham  were  under  surveillance 
as  part  of  a  counterterrorism  investigation  called  Operation  Overt.  The  domestic  British 
intelligence  agency,  MI5,  tapped  the  phones,  monitored  the  bank  accounts,  tracked  the  email, 
watched  the  travel  patterns,  and  bugged  the  apartments  of  several  young  men  in  Walthamstow.443 

Also  in  December  2005,  British  officials  informed  their  Pakistani  and  American  counterparts  of 
their  activities.  Authorities  from  Pakistan  began  assisting  with  the  investigation,  suspicious  that 
many  of  the  men  in  Birmingham  and  Walthamstow  had  ties  to  Pakistan,  given  their  Pakistani 
ancestry.  By  the  end  of  the  year,  according  to  U.S.  and  European  counterterrorism  officials,  the 
probe  into  the  activities  of  the  young  men  involved  hundreds  of  investigators  in  the  United 
Kingdom,  the  United  States,  and  Pakistan.444 

Initially,  the  inquiry  was  focused  mainly  on  whether  these  people  had  any  ties  to  the  men  who 
had  carried  out  the  attacks  of  July  7,  2005,  or  to  terrorist  cells  in  Pakistan.  However,  in  June 
2006,  one  of  those  under  surveillance  purchased  an  apartment  in  a  house  on  Forest  Road  in 
Walthamstow,  paying  the  equivalent  of  $260,000,  in  cash  for  the  second-floor  flat,  where  the 
martyrdom  videos  were  later  recorded.  This  struck  the  authorities  as  worrisome,  and  their 
concerns  were  heightened  as  they  watched  the  same  six  young  men  visit  the  apartment  on 
multiple  occasions.  After  installing  recording  equipment  in  the  flat,  MI5  agents  realized  that  the 
men  were  meeting  there  to  discuss  a  terrorist  attack  and  to  conduct  chemical  experiments  with  a 
sports  drink  called  Lucozade.445 

During  the  month  preceding  the  arrests,  authorities  concluded  that  the  plot  was  quite  advanced, 
and  the  suspects’  activities  received  the  undivided  attention  of  security  and  intelligence  personnel 
from  that  time  onward.  In  late  July  or  early  August,  it  became  clear  that  the  plotters  intended  to 
target  U.S.  airlines.  While  MI5  and  Scotland  Yard  continued  to  track  the  men’s  activities  on  the 
ground  in  England,  U.S.  intelligence  officials  provided  British  authorities  with  intercepts  of  the 
group’s  communications,  according  to  an  American  official.446 
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Prime  Minister  Blair  informed  President  Bush  of  the  unfolding  details  about  the  plot  during  the 
first  weekend  of  August,  telling  him  that  British  surveillance  indicated  that  there  was  a  specific 
threat  to  U.S.  airlines.  Blair  requested  complete  secrecy  on  any  details  he  provided,  fearing  that 
premature  leaks  would  compromise  the  monitoring  of  the  suspects.  In  the  following  days,  British 
and  American  authorities  continued  to  watch  the  group,  keeping  all  but  the  most  necessary 
officials  out  of  the  loop,  so  that  there  was  less  chance  of  jeopardizing  this  critical  phase  of  the 
investigation.  By  the  second  week  of  August,  officials  in  the  United  Kingdom  were  finalizing 
plans  to  arrest  the  suspects.447 

On  August  9,  the  pace  of  the  investigation  accelerated  in  Pakistan,  perhaps  at  a  speed  unexpected 
by  the  British  and  American  authorities.448  On  that  day  (or  a  few  days  earlier,  according  to  some 
accounts)  Rashid  Rauf,  the  dual  British-Pakistani  citizen  who  had  been  living  in  Bahawalpur,  was 
taken  into  custody  by  Pakistani  authorities.  Some  have  suggested  that  the  arrest  was  also  startling 
to  officials  in  the  United  States  and  United  Kingdom  who  were  working  on  the  case.  In  fact,  it 
may  have  been  Raufs  arrest  in  Pakistan  that  prompted  the  events  of  the  following  day  thousands 
of  miles  away,  when  several  British  citizens  were  taken  into  custody.449 

After  Rauf  was  arrested,  the  British  and  American  investigators  were  concerned  that  others 
suspected  of  being  involved  in  the  plot  might  go  into  hiding.  Within  hours  of  Rauf  s  arrest, 
intelligence  sources  alerted  British  officials  that  someone  affiliated  with  Rauf  in  Pakistan  had 
tried  to  contact  some  of  those  under  surveillance  in  East  London.  Investigators  worried  that  the 
message  might  be  some  sort  of  signal  to  accelerate  the  plot  and  move  forward  with  the  attack, 
although  the  communication  from  Pakistan  does  not  appear  to  have  been  as  explicit  as  the  “go 
now”  directive  that  was  first  reported  by  the  European  Union’s  security  commissioner.450 

Regardless  of  the  precise  content  of  the  message  from  Raufs  associate,  having  conducted  intense 
surveillance  for  so  many  months,  officials  were  not  inclined  to  let  these  suspects  slip  away.  So  in 
the  early  morning  hours  of  August  10,  the  police  surrounded  several  homes  in  East  London,  High 
Wycombe,  and  Birmingham  and  took  more  than  20  individuals  into  custody,  after  alerting  a 
handful  of  U.S.  officials  that  arrests  were  imminent.451 

Following  the  arrests,  British  authorities  raided  a  number  of  locations  over  the  next  several  days 
and  found  chemicals,  electrical  components,  and  documents.  At  the  second-floor  flat  on  Forest 
Road  in  Walthamstow  that  had  been  purchased  by  one  of  the  suspects  in  June,  the  police 
discovered  nearly  a  dozen  empty  sports  drink  bottles,  batteries,  a  bin  filled  with  some  sort  of 
liquid,  rubber  gloves,  and  a  digital  camera  leaking  fluid.452 

In  addition,  in  the  pocket  of  one  of  the  suspects,  police  found  a  computer  memory  stick  that 
contained  information  suggesting  that  he  had  looked  at  the  airline  schedules  for  flights  from 
London  to  various  American  cities.  The  same  suspect  had  a  list  written  on  a  piece  of  paper  that 
referred  to  sports  drink  bottles,  batteries,  and  a  reminder  to  “select  a  date.”  Police  interpreted  this 
information  as  a  “step-by-step  plan  for  attack.”453  By  August  21,  investigators  had  conducted  69 
searches  in  Walthamstow,  High  Wycombe,  Birmingham,  and  other  locations  and  had  found  more 
than  400  computers,  200  cellular  telephones,  and  more  than  8,000  memory  sticks,  DVDs,  and 
CDs  of  information.454 

Also  on  August  21,  Paul  Clarke,  Scotland  Yard’s  chief  antiterrorist  official,  announced  that 
several  of  those  taken  into  custody  1 1  days  earlier  had  been  charged  with  various  crimes, 
including  “Conspiracy  to  Murder  and  Preparing  Acts  of  Terrorism,”  under  the  British  Terrorism 


81 


Underlying  Reasons  for  Success  and  Failure  of  Terrorist  Attacks 


Act  of  2006.  The  majority  of  those  arrested  in  August  2006  remain  in  custody  in  the  United 
Kingdom,  where  a  trial  for  the  suspects  is  unlikely  to  begin  until  sometime  in  2008.455 

Consequences 

Because  the  plot  was  discovered,  no  attack  occurred.  There  was  short-term  system  disruption 
within  the  United  Kingdom,  as  Heathrow  Airport  was  temporarily  closed  to  most  flights  from 
Europe,  and  several  flights  from  England  to  cities  in  the  United  States  were  cancelled.  Over  on 
the  other  side  of  the  Atlantic,  the  Transportation  Security  Administration  immediately 
implemented  changes  in  screening  practices,  and  those  departing  from  aiiports  in  the  United 
States  found  that  they  could  no  longer  bring  liquids  or  gels  in  their  carry-on  luggage,  nor  could 
they  bring  beverages  purchased  within  the  security  perimeter  onto  the  plane.456  In  addition,  there 
was  extensive  international  media  coverage  of  this  plot  during  the  first  few  weeks  after  it  was 
uncovered. 

The  psychological  impact  associated  with  the  public’s  awareness  of  this  plot  can  be  characterized 
as  moderate.  Although  there  are  no  data  available  to  indicate  the  reaction  of  Britons,  Americans, 
and  others  to  news  of  the  planned  attack,  it  seems  likely  that  they  would  have  been  alarmed  to 
hear  about  it.  This  would  have  been  especially  true  in  the  first  few  days  after  the  arrests  were 
made,  when  it  seemed  as  if  the  attack  had  been  averted  at  the  last  minute.  At  the  same  time,  the 
psychological  impact  of  this  event  was  not  great  enough  to  cause  people  not  to  fly.  Although  this 
event  also  had  moderate  economic  impact,  the  results  were  not  lasting,  mainly  limited  to  the  extra 
costs  associated  with  higher  levels  of  security  in  the  United  Kingdom  and  the  United  States.  The 
British  Aiiports  Authority  (the  owner  and  operator  of  London’s  Heathrow  and  Gatwick  Airports) 
estimated  that  it  spent  the  equivalent  of  $24.3  million  on  additional  security  measures  following 
the  arrests  of  August  1 0,  2006.457 

With  regard  to  policy,  the  threat  of  liquid  explosives  exposed  by  this  plot  prompted  lasting 
changes  in  security  procedures  at  airports  in  the  United  Kingdom  and  the  United  States. 
Passengers  are  required  to  limit  the  amount  of  liquids  and  gels  in  their  carry-on  luggage  and  must 
carry  all  items  in  clear  plastic  bags,  so  that  they  can  be  easily  examined  by  screeners  at  security 
checkpoints.  This  is  evidence  of  the  law  enforcement  learning  that  emerges  from  this  plot.458 

Finally,  there  is  no  evidence  to  suggest  that  the  plot  had  either  a  positive  or  negative  impact  on 
the  population  that  would  have  provided  support  to  the  suspects. 

Factors  Associated  With  Success  or  Failure 

Although  the  plot  was  unsuccessful  at  the  tactical,  operational,  and  strategic  levels,  there  were 
factors  involved  that  could  have  contributed  to  success,  had  this  operation  gone  forward  as 
planned,  as  well  as  factors  that  ultimately  resulted  in  its  failure. 

Training :  Although  the  planned  operation  was  described  as  “sophisticated”  by  some  officials,  this 
characterization  may  have  referred  more  to  the  advanced  stages  of  planning  rather  than  to  the 
tactic  involved.459  This  appears  to  have  been  a  fairly  simple  operation  and  required  little 
specialized  instruction.  The  one  exception  to  this  may  have  been  mixing  the  liquid  explosives  and 
detonating  them  once  the  plotters  were  on  board  the  airliners.  Whether  those  involved  had 
sufficient  training  to  do  this  is  unknown. 
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Technical  sophistication:  Somewhat  related  to  training,  there  are  also  uncertainties  with  regard  to 
the  technical  sophistication  of  the  plotters.  Had  the  plot  gone  operational,  did  the  suspects  have 
the  know-how  to  properly  manufacture  liquid  explosives?  Would  these  bombs  have  been  able  to 
destroy  the  planes?  According  to  a  chemist  involved  in  the  plot  investigation,  hexamethylene 
triperoxide  diamine  (HMTD),  one  of  the  peroxide-based  explosives  that  the  suspects  may  have 
considered  in  their  plan,  is  dangerous,  in  theory.  However,  the  chemist  also  indicated  that  whether 
the  alleged  plotters  had  “the  brights  to  pull  it  off’  is  not  yet  known.460  Even  if  they  had  the  skills 
necessary  to  mix  the  explosives  properly  and  were  able  to  smuggle  them  onto  airplanes,  at  least 
one  U.S.  official  said  he  did  not  know  whether  those  particular  explosives  would  have  succeeded 
in  bringing  down  the  planes.461 

Operational  proficiency:  Since  the  plot  was  foiled  prior  to  execution,  and  there  were  no  known 
dry  runs,  there  is  no  information  to  indicate  whether  the  plotters  would  have  been  proficient  in 
assembling  the  bombs  on  board  the  aircraft  and  detonating  the  explosives. 

Terrorist  profile  indicators:  All  of  those  involved  in  this  plot  were  British  citizens,  and  with  the 
possible  exception  of  Rashid  Rauf,  the  suspect  arrested  in  Pakistan,  the  men  would  have  had  little 
reason  to  draw  the  attention  of  the  authorities,  had  it  not  been  for  their  observant  neighbors.  (See 
Obsen’ant public  or  vigilant  security  services .)  Described  as  just  “normal  guys,”  it  seems  mostly 
in  hindsight  that  the  some  of  the  plotters’  behavior  seemed  odd  to  their  acquaintances.462 

Further,  while  the  suspects  would  have  needed  passports  to  board  flights  to  the  United  States,  as 
British  citizens,  they  would  not  have  required  visas.  The  U.K.  is  just  one  of  27  visa-waiver 
countries — the  visa-waiver  program  is  a  reciprocal  program  that  encourages  travel  between  the 
United  States  and  some  of  its  closest  allies.  Citizens  of  visa-waiver  countries,  such  as  those  who 
plotted  this  operation,  can  board  flights  to  the  United  States  with  nothing  more  than  a  machine- 
readable  passport,  thereby  avoiding  any  scrutiny  from  American  officials  prior  to  arriving  in  the 
United  States.463 

Terrorist  OP  SEC:  The  activities  of  the  suspects  were  under  observation  from  the  plot’s  early 
stages,  due  to  the  neighbors’  report  of  their  angry  behavior  sometime  after  the  subway  bombings 
of  July  2005.  Even  if  the  plotters  had  practiced  good  operational  security  while  preparing  the 
attack,  it  is  likely  that  their  plans  would  have  been  uncovered  before  the  operation  could  have 
been  carried  out  due  to  existing  surveillance  by  British  authorities. 

Innovation:  Although  the  planned  tactic  for  this  plot  was  unusual,  it  was  certainly  not 
unprecedented,  as  the  earlier  description  of  the  Bojinka  plot  reveals.  As  mentioned  earlier,  the 
suspects  chose  liquid  explosives  because  of  their  belief  that  the  weapons  would  be  able  to 
circumvent  the  security  practices  in  place  in  August  2006. 

Law  enforcement  or  intelligence  knowledge:  This  factor  was  also  key  to  the  failure  of  this  plot, 
and  once  the  men  were  noticed  by  their  neighbors  and  their  behavior  was  reported  to  the  local  law 
enforcement,  the  plotters  were  put  under  an  “unprecedented  level”  of  surveillance  that  was 
ongoing  for  several  months  before  the  arrests  were  made. 464 

Security  environment:  Although  law  enforcement  personnel,  government  officials,  and  the 
general  public  were  highly  cognizant  of  the  possibility  of  terrorist  attacks,  given  the  events  of 
September  11,  2001,  and  the  subway  bombings  in  July  2005,  security  measures  in  place  in 
August  2006  might  not  have  prevented  the  attack,  had  it  entered  the  operational  phase.  The 
suspects  chose  to  use  liquid  explosives  knowing  that  this  tactic  would  likely  pass  through  existing 
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security  practices  without  being  detected.  American  aviation  experts  have  indicated  that  airport 
screening  devices  have  a  difficult  time  sensing  the  types  of  chemicals  that  the  plotters  were 
planning  to  use  in  their  attack.  In  addition,  British  security  officials  suggested  that  the  same 
technique  might  have  been  used  again  repeatedly,  because  detecting  the  types  of  materials  used  to 
destroy  the  airliners  would  have  been  nearly  impossible  after  the  attack.465 

Effective  information  sharing  and  international  cooperation'.  In  a  plot  with  international  scope,  as 
this  one  had,  effective  information  sharing  domestically  and  internationally  is  critical,  and  both 
contributed  to  the  failure  of  this  planned  operation.  Within  the  United  States,  government 
officials  said  that  the  plot  investigation  relied  on  intelligence  agencies  and  law  enforcement 
entities  working  together  in  a  seamless,  coordinated  way.466  Internationally,  there  were  frequent 
communications  between  British  and  American  personnel  investigating  the  plot,  as  observation  of 
the  suspects  continued.  Those  involved  in  the  law  enforcement  and  intelligence  activities  in  the 
United  Kingdom  and  United  States  were  described  as  “joined  at  the  hip,”  and  this  close 
cooperation  was  a  key  factor  in  the  failure  of  the  plot.467 

Observant  public  and/or  vigilant  security  services:  Of  all  factors,  these  two  contributed  the  most 
to  failure  of  this  plot.  One  of  the  clearest  reasons  that  this  attack  did  not  go  forward  as  the 
terrorists  had  planned  was  an  informed  and  motivated  public.  According  to  a  senior  European 
intelligence  official,  British  authorities  opened  their  investigation  into  the  plot  after  receiving  the 
report  about  the  angry  young  Muslims  from  worried  residents  of  Walthamstow,  who  were 
Muslims  themselves.468  If  these  citizens  had  not  called  the  authorities,  this  plot  might  have 
developed  as  the  suspects  had  intended.  If  the  residents  of  that  East  London  neighborhood  had  not 
lived  through  the  July  7,  2005,  bombings,  would  they  have  been  concerned  about  their  neighbors? 
The  unraveling  of  this  plot  was  also  a  result  of  effective  community  policing.  Had  the  residents  in 
Walthamstow  been  unaware  of  their  local  police  or  uncomfortable  sharing  information  with  them, 
there  is  a  chance  that  the  citizens  might  not  have  shared  with  the  local  law  enforcement  concerns 
about  their  neighbors.  If,  having  received  the  report,  the  police  had  ignored  the  information,  this 
might  have  provided  another  opportunity  for  the  suspects  to  continue  their  activities  without 
surveillance. 

Findings 

To  a  great  extent,  the  discovery  of  the  plot  was  based  on  the  observations  of  concerned  citizens 
who  saw  their  neighbors  acting  suspiciously  and  called  the  authorities.  Those  who  received  the 
calls  were  well-trained  and  recognized  that  the  citizens’  concerns  were  valid  and  passed  the 
reports  through  appropriate  channels.  As  the  investigation  evolved,  existing  information- sharing 
practices  facilitated  communication  both  within  the  United  Kingdom  and  with  allies  abroad, 
especially  with  those  in  the  United  States,  and  the  plot  was  broken  up  before  it  could  be  executed. 

Had  the  observant  citizens  not  noticed  their  neighbors’  behavior,  not  thought  it  worth  reporting  to 
the  authorities,  or  been  reluctant  to  report  it,  or  had  the  authorities  done  nothing  with  the 
information  once  they  received  it,  the  operation  might  have  gone  forward  as  the  plotters  had 
intended.  Questions  remain  about  whether  the  men  would  have  been  able  to  manufacture  their 
explosives  successfully  and  whether  those  weapons  would  have  brought  down  the  airliners. 
However,  given  the  state  of  airport  screening  technology,  the  terrorists  likely  would  have  been 
able  to  smuggle  the  explosives  components  aboard  the  planes  without  detection,  bringing  them 
one  step  closer  to  their  plot  to  bring  down  American  airliners  over  the  Atlantic. 
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Section  IV — Findings 


Influence  of  Factors 

Based  on  the  cases  outlined  in  this  study,  some  conclusions  can  be  drawn  regarding  the  influence 
of  certain  factors  on  the  success  or  failure  of  attempted  terrorist  attacks  at  the  tactical,  operational, 
and  strategic  levels. 

Accessibility 

While  Phase  I  of  this  study  considered  accessibility  to  be  a  contributing  factor  for  successful 
attacks,  our  findings  are  mixed.  Phase  II  found  that  in  the  cases  examined,  rail  targets  are  easily 
accessible.  The  Aum  Shinrikyo  attackers,  the  July  7  bombers,  and  the  July  21  bombers  all  were 
able  to  access  multiple  targets  without  hindrance,  and  there  is  no  reason  to  believe  that  the  New 
York  City  plotters  could  not  have  done  the  same. 

However,  the  more  restrictive  access  for  airliners  does  not  appear  to  have  had  an  impact  on  the 
success  or  failure  of  those  attacks;  rather,  the  level  of  access  merely  presented  obstacles  that  were 
overcome  with  planning  and  ingenuity.  The  Air  France  hijackers  circumvented  security  by  use  of 
disguise  and  false  identification;  this  is  a  significant  point  because  it  demonstrates  the 
vulnerability  of  the  commercial  aviation  sector  to  “insider”  attack,  whether  by  those  legitimately 
employed  as  ground  personnel  or  by  those  who  can  provide  uniforms  and  documentation  to  co¬ 
conspirators.  And  because  terrorists  have  demonstrated  a  tendency  to  revive  tactics  used  in  the 
past,  it  is  conceivable  that  future  attempts  would  also  involve  such  deceptive  tactics.  In  the  case 
of  the  Bojinka  plot,  Ramzi  Yousef  was  able  to  bypass  barriers  to  bringing  weapons  onboard  the 
Philippines  Airlines  aircraft  in  his  dry  run;  there  is  a  good  chance  he  would  have  been  able  to  do 
so  for  the  main  attack  as  well.  The  9/1 1  hijackers  likewise  circumvented  such  barriers,  in  their 
case  not  once,  but  on  four  separate  aircraft.  And  while  the  liquid  explosives  plot  never  reached 
the  execution  phase,  the  plotters  had  devoted  significant  time  and  effort  to  devise  a  means  to 
bypass  security  screening  and  deploy  the  weapons  on  board  the  aircraft. 

Based  on  the  lessons  gained  from  these  case  studies,  it  can  be  concluded  that  accessibility  is  not 
necessarily  a  significant  factor  contributing  to  the  success  or  failure  of  an  attack,  but  may  merely 
provide  an  obstacle  to  be  overcome. 

Training 

The  degree  to  which  a  terrorist  team  is  ready  for  execution  can  influence  (but  not  always 
determine)  the  outcome  of  the  initial  stages  of  the  attack  and  its  consequences.  Two  of  the  most 
successful  operations — 9/1 1  and  the  July  7  attack — were  carried  out  by  well-trained,  disciplined 
teams.  Conversely,  the  July  21  bombers  seemed  to  have  all  other  factors  working  in  their  favor, 
but  lack  of  proper  training  in  the  preparation  of  the  main  charge  resulted  in  failure  of  the  attack  to 
be  carried  out  as  the  terrorists  had  planned.  Aum  Shinrikyo  had  the  benefit  of  a  cadre  of  scientists 
and  engineers  who  had  successfully  employed  chemical  weapons  in  the  past;  however,  despite 
this  high  degree  of  training,  the  weapons  functioned  only  partially  when  initiated. 
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Operational  Proficiency  and  Technical  Sophistication 

The  operational  proficiency  of  a  terrorist  or  group  of  terrorists  refers  to  their  skills,  abilities, 
expertise  and  aptitude  at  carrying  out  their  plan  and  using  their  weapon(s)  effectively.  This  is  not 
to  be  confused  with  technical  sophistication,  although  the  two  can  be  correlated.  Technical 
sophistication  refers  to  how  complex  the  plan  or  weapon(s)  are.  It  does  not  necessarily  follow  that 
a  terrorist  is  more  proficient  because  their  plan  or  weapon(s)  are  more  sophisticated  or  complex; 

A  terrorist  can  be  proficient  at  using  a  simple,  non-sophisticated  weapon,  as  well  as  be  proficient 
at  the  use  of  a  more  complex  weapon.  Similarly,  a  terrorist  can  lack  proficiency  for  using  a 
simple  or  complex  weapon. 

Our  findings  show  that  the  level  of  sophistication  of  an  attack  may  or  may  not  correlate  with  the 
terrorists’  proficiency  or  more  indicators  of  success  or  failure.  For  example,  the  9/1 1  attack 
required  a  high  degree  of  technical  sophistication  by  the  planners,  necessitating  acquisition  of 
specialized  flight  training  as  well  as  coordination  on  the  timing  of  the  attacks.  The  terrorists  who 
executed  the  attack  were  operationally  proficient  because  they  were  able  to  carry  out  their  attack 
successfully.  The  Air  France  hijacking  and  plot  to  destroy  the  aircraft  over  Paris,  on  the  other 
hand,  required  less  sophistication  as  it  was  a  more  traditional  hostile  airplane  takeover.  The  GIA 
terrorists  needed  only  to  commandeer  the  aircraft  and  compel  the  aircrew  to  fly  to  their  target,  at 
which  time  the  hijackers  only  had  to  detonate  the  dynamite  on  board  the  aircraft,  however,  they 
were  not  proficient  enough  to  carry  out  their  plan  in  its  entirety. 

In  the  Aum  Shinrikyo  attack,  the  terrorists  created  a  fairly  complex  weapon  of  lethal  sarin  gas  and 
had  a  coordinated  plan  for  carrying  out  their  attacks.  And  while  they  were  able  to  carry  out  part  of 
their  plan  and  have  operational  and  strategic  effects,  they  did  not  have  full  technical 
sophistication  because  the  impurity  of  the  sarin  they  made  decreased  its  lethality  and  provided  a 
warning  indicator — an  unusual  odor — to  potential  victims.  Nevertheless,  the  sophistication  of 
Aum’s  weapon  makers  was  sufficient  to  create  a  weapon  with  lethal  effects,  thus  creating  an 
impact  at  the  strategic  level. 

One  way  that  terrorists  can  become  more  proficient  is  to  conduct  dry  runs  or  rehearsals.  This  type 
of  behavior  could  be  detected  by  alert  security  services  who  perhaps  could  intervene  before  an 
attack  occurred.  Each  rehearsal  carries  the  risk  that  authorities  or  an  observant  public  will  detect 
their  activity.  For  complex  attacks,  the  groups  may  also  need  training  in  certain  areas  that  require 
travel  or  contact  with  persons  already  under  surveillance  by  security  services.  Even  training  that 
is  acquired  through  legitimate  means,  for  example  commercial  flight  training,  could  raise  a 
group’s  profile  and  subject  it  to  scrutiny. 

Security  measures  can  increase  the  level  of  sophistication  and/or  proficiency  required  to  carry  out 
an  attack  successfully.  For  example,  more  comprehensive  airline  screening  techniques  may  have 
forced  terrorists  to  turn  to  complicated  homemade  explosives  that  require  considerable  technical 
proficiency  to  create,  test,  covertly  deploy,  assemble,  and  detonate.  By  raising  the  level  of 
technical  sophistication  required  by  terrorists,  and  increasing  the  knowledge  and  training  it  takes 
to  be  operationally  proficient,  such  measures  may  force  groups  to  increase  rehearsals  and  conduct 
training  that  increases  the  probability  that  they  will  be  detected  before  executing  the  attack. 
Alternatively,  this  may  redirect  the  terrorists  to  other,  more  easily  attacked  targets. 
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Terrorist  Profile  Indicators 

Defending  against  attack  would  be  much  simpler  if  there  were  certain  indicators  that  were  always 
present  in  the  background  of  terrorists.  Our  analysis,  however,  finds  that  this  is  not  the  case. 

There  are  several  factors  that  could  be  indicators,  particularly  if  present  in  combination;  however, 
terrorist  groups  have  become  adept  at  recruiting  members  with  no  obvious  indicators  of  their 
intent. 

In  some  instances,  terrorists  will  have  participated  in  earlier  attacks.  For  example,  the  members  of 
Aum  Shinrikyo  had  conducted  several  operations,  albeit  on  a  smaller  scale,  prior  to  their  sarin 
attack.  The  hijackers  of  Air  France  8969  had  also  participated  in  earlier  terrorist  attacks,  and  were 
known  members  of  the  GIA.  Two  of  the  plotters  behind  the  Bojinka  plan — Ramzi  Yousef  and 
Abdul  Murad — were  directly  involved  in  the  attack  on  the  World  Trade  Center  in  1993.  Gazi 
Ibrahim  Abu  Mezer,  leader  of  the  plot  on  the  Brooklyn  subway,  had  been  suspected  of  ties  to 
Hamas. 

Participation  in  criminal  activity  can  also  be  an  indicator.  Aum  Shinrikyo  supported  its  terrorist 
agenda  through  money  earned  in  both  legitimate  and  illegal  enterprises.  Mezer  had  been  arrested 
twice  while  living  in  Canada,  and  had  been  involved  in  several  illegal  border  crossing  incidents. 
One  of  the  July  2 1  plotters,  Muktar  Said  Ibrahim,  spent  several  years  in  prison  for  gang-related 
robberies. 

Severing  ties  with  one’s  social  support  structure  could  indicate  involvement  in  a  group  that 
espouses  violence.  The  members  of  Aum  Shinrikyo  left  their  families  and  adopted  the  group  as 
their  new  identity,  giving  supreme  allegiance  to  Asahara.  However,  some  terrorists  do  not  make 
such  a  clean  break.  Those  behind  the  plots  against  the  London  transit  system  and  the  planned 
liquid  explosives  attack  maintained  their  social  and  familial  ties,  while  creating  new  connections 
with  radical  extremists.  For  example,  Shehzad  Tanweer  and  Mohammed  Sidique  Khan  were 
known  by  MI5  to  be  in  contact  with  individuals  involved  in  another  plot,  and  possibly  with  the 
July  21  plotters.  And  while  some  of  their  families  later  said  they  noticed  changes  in  Tanweer  and 
Khan’s  behavior,  they  also  stated  they  were  shocked  when  they  were  connected  to  the  July  7 
attacks. 

Of  note,  several  terrorists  mentioned  in  this  study  attended  mosques  known  to  authorities  for  their 
espousal  of  violence.  London’s  Finsbury  Park  Mosque  was  frequented  by  three  of  the  July  21 
plotters;  the  terrorists  planning  to  attack  the  Brooklyn  subway  attended  the  radical  A1  Farooq 
mosque;  Ramzi  Yousef  also  attended  A1  Farooq  prior  to  the  World  Trade  Center  attack  in  1993. 
Security  authorities  should  continue  to  pay  particular  attention  to  suspicious  activities  that  are 
associated  with  such  venues. 

Sometimes  terrorists  must  travel  to  receive  operational  instructions  or  training  for  their  attacks. 
Pakistan  was  visited  by  at  least  one  person  involved  in  Bojinka,  the  liquid  explosives  plot,  and 
both  plans  to  attack  the  London  transit  system.  However,  like  other  indicators,  this  is  not 
sufficient  evidence  in  itself — thousands  of  people,  particularly  those  with  family  ties  there,  travel 
to  Pakistan  every  year. 

While  the  presence  of  such  indicators  can  aid  in  identifying  potential  terrorists,  they  are  not  a 
foolproof  means  of  finding  such  individuals.  As  the  shift  to  homegrown  terrorists  exemplifies, 
terrorist  organizations  learn  our  techniques  and  shift  their  recruiting  strategy  to  avoid  creating  a 
typical  profile  that  can  be  exploited  by  security  services. 
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Law  Enforcement  or  Intelligence  Knowledge 

This  factor  appears  to  have  a  great  deal  of  influence  on  the  success  or  failure  of  an  operation. 
Cases  in  which  law  enforcement  and/or  intelligence  services  were  alerted  to  and/or  acted  upon 
suspicious  behaviors  demonstrated  the  greatest  number  of  failure  indicators.  Although  the 
Bojinka  plot  had  progressed  through  several  successful  dry  runs,  the  attacks  on  the  airliners  did 
not  occur  because  Philippine  authorities  were  able  to  discover  the  details  of  the  plot  early  enough 
to  interrupt  it  prior  to  the  execution  phase.  The  New  York  City  subway  bomb  plot  was  thwarted 
because  police  worked  swiftly  with  the  windfall  of  information  they  gained  and  discovered 
enough  details  to  interdict  the  plot  before  the  bombers  deployed.  Probably  the  best  example, 
though,  is  the  liquid  explosives  plot.  Early  intelligence,  taken  seriously  by  MI5  and  shared  with 
key  partners,  allowed  the  authorities  to  shut  down  the  plot  before  its  execution. 

The  case  studies  also  indicate  the  importance  of  a  knowledgeable  and  sensitized  security  service 
that  recognizes  the  importance  of  early  warning  and  indicators  and  acts  on  the  information, 
however  incomplete.  The  Japanese  security  services  had  reason  to  suspect  that  Aum  would 
continue  to  conduct  violent  acts  and  indeed  to  escalate  the  level  of  violence.  However,  they  did 
not  act  against  the  organization.  If  Martin  Gilbertson’s  claim  is  true,  that  he  notified  authorities  of 
the  suspicious  activities  of  the  future  July  7  bombers,  then  this  represents  another  missed 
opportunity  that  could  have  led  to  failure  of  that  plot  on  the  tactical,  operational,  and  strategic 
levels.  On  the  other  hand,  the  ability  of  police  and  security  authorities  to  recognize  the 
importance  of  information  in  the  Bojinka,  New  York  City  subway  plot,  and  liquid  explosives 
plots  reflects  the  impact  that  can  be  gained  by  leveraging  this  factor.  This  requires  analytic 
training  of  police  and  intelligence  officers,  as  well  as  expedited  dissemination  of  current  threat 
information. 

Security  Environment 

There  does  not  appear  to  be  a  strong  relationship  between  the  security  environment  and  the 
success  or  failure  of  an  operation.  Restrictive  or  somewhat  restrictive  environments  did  not 
prevent  successes  in  either  the  London  case,  the  Air  France  hijacking,  or  9/11;  however, 
restrictive  environments  may  have  contributed  to  failure  in  the  liquid  explosives  plot,  in  which 
the  conspirators  were  under  heavy  surveillance  by  authorities.  The  Aum  case  transpired  in  a 
permissive  security  environment,  yet  its  successes  were  mixed. 

One  could  make  the  argument  that  the  increased  security  at  airports  has  impacted  operational 
planning  by  forcing  terrorists  to  shift  to  other  target  sets  or  even  other  countries.  However,  there 
is  no  specific  evidence  to  support  a  clear  cause  and  effect  relationship. 

In  some  cases,  however,  restrictive  environments  can  work  in  the  favor  of  the  attackers.  First,  an 
attack  that  occurs  despite  stringent  laws  and  great  latitude  for  authorities  can  have  a  larger 
psychological  and  economic  impact  on  both  target  and  friendly  populations.  Second,  attacks  that 
result  in  a  more  secure  environment — at  the  perceived  cost  of  certain  civil  liberties — can  lead  to  a 
strategic  gain  for  terrorists. 

Observant  Public  and  Vigilant  Security  Services 

The  case  studies  indicate  that  this  is  one  of  the  most  significant  factors  for  causing  failure.  The 
clearest  example  is  the  failure  of  the  liquid  explosives  plot.  That  conspiracy  was  identified  early 
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because  an  alert  member  of  the  public,  sensitized  after  the  July  2005  bombings,  turned  important 
information  over  to  security  authorities.  Since  the  security  services  recognized  the  significance  of 
the  information,  that  plot  was  likely  to  fail  from  that  point  on.  The  New  York  City  case  was  also 
thwarted  because  of  the  tandem  factors  of  an  observant  public  and  a  well-trained  police  force. 

Other  recent  examples  indicate  the  value  of  observant  citizens  passing  information  to  vigilant 
security  services.  Operation  Crevice,  the  investigation  of  the  Britons  who  intended  to  create 
fertilizer  bombs,  was  initiated  after  an  employee  of  a  self-storage  facility  reported  to  MI5  that 
several  men  were  storing  suspicious  amounts  of  fertilizer  in  one  of  their  lockers.469  In  the  U.S.,  a 
store  clerk  reported  to  authorities  that  he  had  been  asked  to  dub  a  video  of  men  shooting  weapons 
and  making  jihadist  statements.470 

Effective  Information  Sharing 

This  is  another  factor  that  the  case  studies  indicate  has  a  significant  impact  on  success  or  failure. 
Had  information  been  shared  effectively  among  the  Japanese  national  police,  prefecture  police, 
and  security  service,  the  threat  presented  by  Aum  might  have  been  taken  more  seriously  and  the 
attack  thwarted.  Conversely,  the  Long  Island  Railroad  police  officers  who  received  the  initial 
report  in  the  1997  plot  shared  the  information  with  the  New  York  Police  Department,  which 
passed  the  information  to  the  special  operations  section  that  planned  and  executed  the  arrest  of 
the  plotters.  In  a  similar  manner,  Philippine  security  services  effectively  shared  vital  information, 
transforming  what  would  have  been  a  minor  incident  into  a  robust  counterterrorist  investigation 
that  interdicted  a  major  international  terrorist  plot.  As  a  result,  mechanisms  that  enable  local  law 
enforcement  to  share  information  with  appropriate  intelligence  nodes  should  be  encouraged.  This 
could  include  the  exchange  of  liaison  officers;  creation  of  incident  databases  which  are  accessible 
by  all  concerned  agencies;  and  creation  of  joint  task  forces  with  regional  or  threat-specific  focus. 

Technical  Difficulties 

Technical  difficulties  can  be  the  result  of  factors  within  the  control  of  terrorists  or  of  outside 
influences.  For  example,  the  technical  difficulties  in  the  July  21  plot  were  due  to  the  lack  of 
technical  sophistication  on  the  part  of  the  bomb  maker  or  makers.  However,  the  sarin  released  by 
the  Aum  attackers  may  have  been  rendered  less  effective  by  an  external  factor,  namely,  the 
weather  conditions.  In  either  case,  the  success  or  failure  of  the  operation  may  hinge  on  the  ability 
of  the  attack  cell  to  identify  and  overcome  such  difficulties — as  Hasib  Hussain  may  have  done  on 
July  7  by  replacing  the  power  source  on  his  weapon.  This  is  dependent,  to  a  great  extent,  on  the 
terrorists’  level  of  operational  proficiency  as  well  as  robust  planning  which  accounts  for  such 
possibilities. 

International  Cooperation 

As  terrorist  plots  become  more  globalized,  it  is  increasingly  important  that  states  share 
information  regarding  suspects  and  plots.  Even  homegrown  terrorists,  such  as  those  behind  the 
July  7  attacks,  often  have  traveled  to  other  countries,  received  support  from  overseas,  or  in  other 
ways  had  ties  beyond  the  immediate  target  country.  More  robust  cooperation  between  the  U.K. 
and  Pakistan  might  have  led  to  information  identifying  the  conspirators  and  their  plan;  one  year 
later,  such  cooperation,  along  with  information  shared  with  the  United  States,  helped  uncover  the 
liquid  explosives  plot.  The  details  of  such  cooperation  are  rarely  publicly  available,  but  they  often 
involve  bilateral  or  multilateral  agreements  to  exchange  information  between  the  security  services 
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of  affected  countries.  There  are  issues  regarding  how  much  information  will  be  released, 
particularly  regarding  sources  and  methods.  However,  it  is  in  the  best  interest  of  the  parties 
involved  to  exchange  as  much  information  as  they  can  with  other  states  that  may  have  a  piece  of 
the  puzzle. 

In  creating  such  networks  of  international  cooperation,  Western  states  may  have  to  shift  from  the 
Cold  War  mindset.  While  ties  with  the  U.K.,  Australia,  Japan,  and  NATO  countries  remain  vital, 
we  must  also  create  relationships  with  countries  we  would  not  have  deemed  fruitful  or 
trustworthy  in  the  past.  Terrorists  operate  support  networks,  training,  and  safe  houses  throughout 
South  Asia,  the  Middle  East,  Africa,  Asia,  and  Latin  America.  Creating  networks  of  cooperation 
in  these  regions  would  help  deny  sanctuary  from  which  plans  against  Western  targets  are 
developed. 

Terrorist  Operational  Security  (OPSEC) 

The  case  studies  indicate  that  the  degree  to  which  OPSEC  influences  success  or  failure  depends 
on  whether  other  factors  are  present:  specifically,  an  observant  public,  vigilant  security  services, 
and  information  sharing.  Lapses  in  OPSEC  can  be  effectively  exploited  if  any  or  all  of  these  other 
factors  are  present. 

The  New  York  City  subway  plot  is  a  good  example  of  this.  The  plotters  assembled  weapons  that 
would  have  worked  as  designed,  chose  a  vulnerable  target  with  easy  access,  and  conducted  pre- 
operational  surveillance.  The  plot’s  failure  was  due  to  one  instance  of  poor  OPSEC — when  one  of 
the  terrorists  discussed  the  plot  and  showed  the  weapons  to  a  person  not  involved  in  the  plot  who 
was  not  vetted.  However,  had  that  person  not  taken  the  boast  seriously,  the  plan  would  have  gone 
forward  to  the  execution  phase.  Likewise,  had  the  informant’s  report  not  been  taken  seriously  by 
law  enforcement,  the  attack  would  have  occurred,  most  likely  the  following  day. 

The  liquid  explosives  plot  demonstrates  that  information  sharing  is  crucial  for  taking  advantage 
of  OPSEC  lapses.  A  member  of  the  community,  observant  of  radical  activity  in  his  area,  knew  to 
report  the  activity  to  authorities.  The  authorities  knew  to  follow  up  on  this  information  and  were 
able  to  avert  a  catastrophic  attack. 

Once  again,  community  policing  can  be  an  important  catalyst.  Police  officers  who  are  embedded 
within  strategic  communities  are  more  likely  to  be  trusted  and  therefore  receive  reports  indicating 
potential  violence.  At  the  same  time,  they  are  more  likely  to  recognize  incidents  that  are  out  of 
the  ordinary  that  merit  further  investigation. 

Innovation 

Innovation  appears  to  provide  an  element  of  surprise  important  for  successfully  executing  an 
attack,  particularly  where  there  are  stringent  security  measures.  The  innovation  of  hijacking  an 
aircraft  with  box  cutters  and  knives  and  of  using  aircraft  as  weapons  provided  the  tactical  surprise 
necessary  for  successful  execution  of  the  9/1 1  attacks.  In  fact,  the  only  aircraft  not  to  reach  its 
target  was  also  the  only  one  where  the  element  of  surprise  had  been  lost.  The  passengers  on  that 
flight  knew  that  aircraft  were  being  crashed  into  buildings,  and  they  reacted  by  attempting  to 
wrest  control  back  from  the  hijackers.  The  use  of  home  grown  terrorists  in  the  July  7  plot 
achieved  tactical  surprise  because  most  previous  terrorist  attacks  were  executed  by  non-natives; 
furthermore,  their  use  of  suicide  tactics  was  innovative  for  Western  Europe.  Aum  achieved  a 
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degree  of  success  because  the  use  of  chemical  weapons  on  a  subway  train  was  innovative  and 
something  for  which  Japanese  authorities  were  not  prepared. 

Innovation  can  also  have  an  impact  in  the  form  of  media  coverage — such  attacks  tend  to  garner 
more  publicity  than  the  repeated  use  of  a  standard  tactic.  Media  coverage  of  the  liquid  explosives 
plot  seemed  driven  not  just  by  the  magnitude  of  the  potential  damage,  but  also  by  the  innovative 
means  devised  by  the  terrorists  for  bringing  the  explosives  on  board. 

Innovation  also  can  result  in  psychological  impact  by  adding  a  new  dimension  of  vulnerability  to 
the  target  population’s  psyche.  The  9/1 1  attacks  left  a  greater  feeling  of  vulnerability  for  the 
flying  public,  generating  severe  economic  impacts  for  the  airline  industry  and  others  dependent 
on  this  mode  of  travel. 
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Policy  Implications 

One  point  stands  out  from  the  incidents  examined  in  this  study:  terrorists  are  rarely  caught  in  the 
act  during  the  execution  phase  of  an  operation.  We  know  of  no  instance  of  a  modem  terrorist 
attack  in  the  United  States  that  was  averted  because  a  terrorist’s  weapon  was  found  during 
screening  or  because  the  attacker  was  identified  and  apprehended  while  attempting  to  execute  the 
attack.  In  fact,  the  only  cases  where  terrorist  attacks  have  failed  during  the  execution  phase  have 
occurred  when  there  has  been  a  technical  failure,  such  as  Richard  Reid’s  shoe  bomb  or  the  July 
2 1  bombing  attempt — and  such  failures  are  not  the  result  of  any  measure  taken  by  security 
services. 

This  is  not  to  say  that  it  is  not  vital  to  employ  screening  equipment,  air  marshals,  and  other 
measures  as  a  last  line  of  defense  against  attack.  Not  only  are  these  activities  necessary  to  thwart 
plots  that  have  not  been  detected,  but  they  also  induce  uncertainty  and  create  obstacles  that 
necessitate  additional  reconnaissance,  dry  runs,  and  other  actions  which  could  be  observed  in  the 
pre-execution  phase. 

However,  history  shows  that  security  services  are  most  effective  in  interdicting  terrorist  plots 
prior  to  the  execution  phase,  that  is,  before  the  attackers  have  deployed  to  their  targets  to 
commence  the  attack.  This  is  reflected  in  the  importance  of  law  enforcement  and  intelligence 
knowledge  of  a  plot’s  details;  that  factor,  in  turn  is  dependent  on  other  factors.  Poor  OPSEC  on 
the  part  of  the  terrorists  can  have  a  tremendous  impact  on  success  or  failure,  but  only  when  other 
conditions  are  in  place.  Security  services  can  not  “cause  ’’poor  OPSEC,  but  they  can  create  the 
conditions  to  capitalize  on  these  mistakes  when  they  occur. 

Observant  Public 

There  must  be  an  observant  and  sensitive  public  that  recognizes  potential  indicators  of  terrorist 
planning.  This  effectively  creates  a  wider  surveillance  net  for  reporting  potential  attack  planning. 
The  British  have  been  effective  in  creating  an  atmosphere  in  which  the  citizenry  note  and  report 
activity  they  regard  as  suspicious,  creating  a  more  difficult  operational  environment  for  terrorist 
planners. 

Aware  and  Responsive  Law  Enforcement  and  Security  Forces 

The  security  apparatus  should  be  knowledgeable  and  sensitive  to  reports  that  may  indicate 
potential  terrorist  planning — in  other  words,  they  should  be  trained  to  know  when  a  report  merits 
further  investigation  or  when  what  appears  to  be  a  simple  criminal  enterprise  may  be  part  of  a 
larger  terrorist  conspiracy. 

For  example,  law  enforcement  should  give  special  attention  to  reports  from  within  the  Muslim 
community  or  other  enclaves  of  potential  radicalization.  Members  of  such  communities  are 
sensitive  to  unusual  activity,  and  may  receive  information  in  confidence  from  acquaintances  that 
have  knowledge  of  potential  attacks.  Such  information  led  to  the  disruption  of  the  plan  to  bomb 
the  New  York  subway  and  the  liquid  explosives  plot. 

Security  services  should  also  pay  close  attention  to  reports  of  unusual  spikes  in  specialized 
training.  If  the  reports  of  Arab  males  enrolling  in  commercial  aviation  classes  had  been  pursued, 
the  9/11  plot  may  have  been  disrupted.  Other  examples  could  include  martial  arts,  scuba,  and 
computer  security.  Authorities  should  also  pursue  reports  of  unusual  requests — for  example,  if 
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only  certain  portions  of  a  training  syllabus  are  requested,  if  payment  is  in  cash,  or  unrealistic 
training  timelines  are  demanded. 

Likewise,  authorities  should  be  sensitive  to  reports  of  the  acquisition  of  large  quantities  of  certain 
materials,  such  as  hydrogen  peroxide,  cell  phones,  or  electronic  watches.  Smaller  quantities  of 
items  in  combination  could  be  suspicious  as  well:  for  example,  hydrogen  peroxide,  acetone  and 
drain  cleaner.  Other  sensitive  items  may  be  stolen  or  acquired  surreptitiously,  as  was  the  case 
with  airport  uniforms  and  credentials  used  in  the  Air  France  hijacking. 

Immigration  violations  should  be  scrutinized.  While  some  terrorists  can  find  legal  means  of 
entering  the  U.S.,  and  homegrown  terrorists  are  already  present,  past  history  indicates  that  some 
terrorists  could  have  been  stopped  before  entering  the  U.S.  The  two  men  behind  the  plot  to  bomb 
the  New  York  subway  benefited  from  lax  procedures  regarding  immigration:  Mezer  had  been 
apprehended  three  times  and  was  free  on  bail,  while  Khalil  was  never  asked  to  prove  that  he  was 
in  transit  through  the  U.S.  on  his  way  to  Ecuador.  Also,  prior  to  the  1993  attack  on  the  World 
Trade  Center,  Ramzi  Yousefs  travel  companion  was  denied  entry;  his  own  passport  was  not 
detected  as  a  forgery. 

The  police  also  should  continue  to  be  trained  to  observe  indicators  of  suspicious  behavior.  It  is 
much  more  likely  that  police  will  spot  a  person’s  behavioral  indicators  than  an  actual  weapon;  in 
fact,  terrorist  methods  of  attack  change  frequently,  yet  patterns  of  behavior  generally  do  not.  Such 
training  could  also  aid  in  the  detection  of  terrorists  during  dry  runs  and  reconnaissance;  this 
further  assists  in  detecting  attacks  in  the  pre-execution  phase.  One  specific  example  would  be 
recognition  of  suspicious  behaviors,  body  language,  or  facial  expressions.  Such  training  could 
lead  to  the  detection  of  terrorists  conducting  pre-operational  surveillance,  a  dry  run,  or  execution 
of  an  attack. 

Sufficient  resources  also  should  be  allocated  to  investigative  agencies.  Past  incidents  have 
indicated  that  some  terrorists  have  been  known  by  security  services,  but  lack  of  resources 
prevented  full  investigation  of  their  activities. 

Community  Policing 

Community  policing  has  the  potential  to  increase  both  the  sensitivity  of  the  public  and  the 
awareness  of  security  forces.  Police  who  are  embedded  in  communities  know — and  are  known 
by — the  residents.  Observant  citizens  are  more  likely  to  approach  such  police  officers  with 
information  regarding  suspicious  activity.  Those  officers  familiar  with  the  daily  activity, 
demographics,  and  other  contextual  information  are  more  likely  to  recognize  information  that 
merits  investigation. 

Information  Sharing 

Finally,  information  must  be  shared  both  horizontally  and  vertically.  Police  and  security  services 
need  to  have  open  conduits  of  information  exchange  with  their  counterparts  due  to  the  mobility 
and  globalization  of  the  terrorist  threat  and  they  must  be  able  to  share  information  upward,  where 
separate  threads  of  information  can  be  woven  together,  and  downward,  where  information  can  be 
used  to  sensitize  frontline  enforcers  to  threats  they  should  be  watching  for.  That  information 
sharing  also  needs  to  cross  international  boundaries;  nearly  every  terrorist  plot  since  9/11  has  had 
some  international  dimension,  whether  it  involves  movement  of  resources,  training,  recruiting,  or 
safe  haven. 
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Appendix  A — Expanded 
Methodology 


We  established  criteria  for  selecting  the  incidents  used  in  this  study  in  order  to  determine  which 
cases  are  most  informative  for  future  policy  and  strategy.  The  cases  needed  to  meet  the  first 
criterion  and  at  least  one  of  the  other  criteria. 

•  Is  there  evidence  of  clear  ties  to  a  terrorist  plan?  The  incident  could  not  be  an  accident  or 
conducted  by  a  disgruntled  or  mentally  ill  individual.  Rather,  they  must  conform  to  the 
definition  of  terrorism  used  in  Phase  I:  “The  unlawful,  calculated,  premeditated  use  of 
violence  or  the  threat  of  violence,  directed  against  noncombatant  persons  or  property, 
both  tangible  and  symbolic,  to  coerce  or  intimidate  a  civilian  population  or  government, 
in  the  pursuit  of  goals  that  are  generally  religious,  political,  social,  or  ideological.” 

•  Does  the  incident  demonstrate  terrorist  learning,  either  as  precedent  or  refinement  of 
prior  tactics?  This  criterion  was  meant  to  capture  whether  the  adversary  has  learned  from 
past  incidents,  or  whether  more  recent  attacks  refined  techniques  or  used  lessons  learned 
from  the  previous  incident.  One  of  the  most  significant  trends  that  research  has  identified 
is  that  terrorist  individuals  and  groups  apply  lessons  from  both  successes  and  failures  of 
past  attacks  in  order  to  plan  new  attacks.  As  one  study  stated,  “a  terrorist  group  skilled  in 
learning  can  find  solutions  to  many  problems,  modify  tactics  and  behaviors, 
systematically  fulfill  its  needs,  and  advance  its  strategic  agenda  by  design.”471 

•  Does  the  case  demonstrate  some  aspect  (for  example,  tactic,  group  characteristic,  target) 
that  is  believed  to  be  a  significant  threat  in  the  future?  Some  cases  raise  issues  that  are  a 
cause  of  concern  for  the  future,  due  to  their  gravity  or  difficulty  in  countering.  For 
example,  attacks  with  chemical,  biological,  or  radiological  weapons  have  been  rare  but 
are  nevertheless  a  cause  of  great  concern  to  security  services  around  the  world. 

Therefore,  those  cases  that  indicate  a  well-developed  capability  or  mature  plan  to  conduct 
an  attack  with  such  a  weapon  (or  similarly  severe  weapon  or  tactic)  warranted  analysis. 

•  Does  the  case  demonstrate  any  particularly  informative  counterterrorism  approaches? 
Because  the  ultimate  intent  of  this  study  is  to  draw  executable  policy  implications  and 
inform  decision  makers  regarding  measures  that  could  frustrate  future  attacks  on  U.S. 
interests,  incidents  demonstrating  countermeasures  that  have  been  successful  in  the  past 
provided  valuable  information.  For  example,  an  analysis  of  the  points  in  an  attack  path 
which  may  be  vulnerable  to  disruption  or  to  countermeasures  could  be  useful  for  current 
and  future  counterterrorism  efforts. 

•  Does  the  incident  demonstrate  a  significant  shift  in  terrorist  trends?  Terrorist  tactics, 
targets,  and  location  of  attack  vary  over  time;  however,  some  of  the  changes  which  occur 
may  result  in  a  major  shift  in  the  threat  environment.  For  example,  the  attacks  of  9/1 1 
caused  the  aviation  sector  to  increase  various  security  measures,  and  the  attacks  on  the 
London  Underground  in  2005  marked  an  awareness  of  the  emergence  of  a  new 
“homegrown”  terrorist  threat. 
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Data  Sources 

The  data  sources  used  to  collect  information  included  interviews  with  subject  matter  experts,  such 
as  federal  security  officials,  police,  foreign  diplomats,  and  members  of  the  aviation  and  rail 
communities;  472  Government  documents;  Congressional  testimony;  commission  reports; 
academic  journal  articles;  and  media  reports.  In  addition,  we  consulted  classified  intelligence 
reports  to  guide  our  analysis.  The  research  team  had  access  to  databases  up  to  the  Top 
Secret/Sensitive  Compartmented  Information  level.  While  this  information  was  very  useful  in 
framing  our  conclusions,  no  classified  data  were  included  in  the  report. 

Evaluation  of  Data 

In  Phase  II,  we  continued  to  refine  the  approach  to  the  defining  the  success  or  failure  of  an 
operation.  This  is  a  difficult  analytical  problem,  since  ultimately  this  is  a  subjective  and 
somewhat  arbitrary  determination.  Furthermore,  attacks  can  be  successful  at  some  levels  and 
failures  at  others. 

As  in  Phase  I,  the  terms  “success”  and  “failure”  are  from  the  terrorists’  perspective:  a  successful 
attack  is  one  in  which  the  terrorists  are  able  to  inflict  casualties  or  damage  or  otherwise  harm  the 
interests  of  the  target  nation.  Conversely,  a  failed  operation  is  one  that  is  not  initiated,  either  due 
to  technical  difficulties  with  the  weapons  or  because  authorities  uncover  the  plot  before  the  attack 
can  be  carried  out  as  the  terrorists  had  planned. 

In  Phase  II,  we  decided  to  examine  “success”  and  “failure”  at  tactical,  operational,  and  strategic 
levels.  For  the  purpose  of  this  study,  those  levels  are  defined  as  follows: 

•  Tactical:  Immediate  damage  from  a  weapon  or  other  method  of  attack — for  example,  the 
infliction  of  casualties  and  material  damage  due  to  the  effects  of  the  weapon. 

•  Operational:  Systemic  disruption  or  other  effects  lasting  weeks  or  months,  such  as 
widespread  media  attention. 

•  Strategic:  Lasting  effects  enabling  terrorists  to  achieve  long-term  goals,  such  as  changes 
in  foreign  or  domestic  policy  or  long-term  economic  or  psychological  damage. 

For  data  evaluation  purposes,  we  created  three  matrices  to  evaluate  each  case  systematically,  and 
so  that  possible  trends  and  patterns  could  be  identified.  The  first  (Attack  Path  Matrix)  breaks 
down  the  event  into  the  steps  required  to  plan  and  execute  the  attack.  The  second  (Success 
Indicator  Matrix)  analyzes  indicators  of  success  or  failure  at  the  tactical,  operational,  and  strategic 
levels,  and  is  divided  into  pre-execution  and  execution  phase  factors.  These  indicators  determine 
the  degree  to  which  an  attack  or  attempt  was  successful  at  each  of  the  three  levels.  It  is  possible 
for  an  attack  to  have  the  attributes  of  success  at  some  levels  and  attributes  of failure  at  others. 

The  final  matrix  (Factors  Matrix)  examines  factors  that  our  analysis  indicates  have  an  impact  on 
the  success  or  failure  of  an  operation;  in  other  words,  the  first  matrix  shows  the  “how,”  the 
second  matrix  shows  the  “what,”  and  the  third  depicts  the  “why.” 

The  information  from  the  matrices  was  then  analyzed  to  allow  us  to  determine  whether  any 
patterns  or  similarities  exist  between  the  cases. 
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Each  case  study  is  then  presented  in  a  narrative  format  to  portray  the  facts  and  issues  involved. 
The  information  gleaned  from  the  three  matrices  is  detailed  in  the  narrative,  and  conclusions  are 
drawn  from  that  data. 

Description  of  Matrices 

The  Attack  Path  Matrix  divides  the  plot  into  the  steps  required  to  conduct  an  attack.  The  matrix 
includes  the  following  categories  into  which  we  either  entered  information  or  chose  from  a  list  of 
response  options: 

•  Planning  Phase 

■  Target  Selection :  What  target  did  the  terrorists  select,  and  what  (if  anything)  do  we 
know  about  why  they  picked  that  target? 

■  Method  Selection-.  What  method  did  the  plotters  use  or  plan  to  use?  What  (if 
anything)  do  we  know  about  why  they  chose  that  method? 

■  Personnel  selection :  Was  this  a  centralized  and  formal  process — for  example,  did  al 
Qaeda  dictate  that  certain  skill  sets  were  needed,  or  that  it  would  vet  all  participants 
for  suitability?  Or  was  this  an  informal  group  of  people  who  knew  one  another? 

■  Intelligence  Gathering  and  Surveillance :  Did  the  terrorists  surveil  the  target  area? 

Did  they  take  photos  and  test  responses?  Did  they  gather  information  about  schedules 
and  security  measures? 

■  Logistics,  Resources,  Materiel,  and  Support  Network-.  How  did  those  involved 
arrange  for  materials,  money,  logistics  (such  as  cars  and  apartments),  and  passports 
or  visas?  Were  they  self-supporting,  or  did  they  have  a  separate  support  cell,  or  an 
outside  benefactor  such  as  al  Qaeda? 

■  Training  (including  rehearsals  and  dry >  runs):  Did  the  terrorists  test  their  weapon 
design?  Did  they  conduct  any  dry  runs?  Did  they  undertake  any  special  training  (for 
example,  flight  school  or  martial  arts)? 

■  Weapon  Assembly.  At  any  point  did  the  plotters  assemble  a  working  weapon  for  the 
attack  (not  for  testing  the  design)? 

•  Attack  Phase 

■  Stage  for  attack :  Were  those  involved  able  to  get  everyone  with  all  necessary 
materials  to  the  right  place  at  the  right  time  for  the  attack? 

■  Execute  Attack :  Were  the  terrorists  able  to  initiate  the  attack  successfully?  Did  the 
weapon  work? 

The  Success  Indicators  Matrix  includes  the  following  indicators  of  success  or  failure,  divided 
by  phase  and  level  of  operation: 

•  Pre-Execution  Phase 

■  Tactical:  Was  the  cell  penetrated  or  compromised? 

■  Operational:  Was  a  larger  network  penetrated  or  compromised? 

■  Strategic:  There  are  no  indicators  at  the  strategic  level  in  the  pre-execution  phase. 
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•  Execution  Phase 

■  Tactical: 

o  Was  the  attack  initiated? 
o  Did  the  weapon(s)  function  as  intended? 
o  How  many  were  killed? 
o  How  many  were  injured? 

o  What  material  damage  resulted  from  the  effects  of  the  weapon? 
o  Were  any  cell  members  arrested  or  killed? 

■  Operational: 

o  To  what  degree  was  the  system  (for  example,  subway  or  air  travel  network) 
disrupted? 

o  Was  there  extensive  media  coverage  of  the  event? 
o  Was  the  attack  against  a  symbolic  target? 
o  Was  a  larger  network  penetrated  or  compromised?473 

■  Strategic: 

o  What  is  the  extent  of  psychological  impact? 

o  What  is  the  extent  of  economic  impact? 

o  Did  the  plot  result  in  any  foreign  or  domestic  policy  changes? 

o  What  was  the  impact  of  the  plot  on  supporting  populations? 

The  Factors  Matrix  illustrates  factors  that  could  contribute  to  the  results  of  the  Success 
Indicators  Matrix.  Those  factors  could  be  attributes  of  the  adversary  or  of  security  services: 

•  Adversary: 

■  Terrorist  Training :  Were  the  plotters  trained  well  enough  to  execute  the  plan 
successfully? 

■  Technical  Sophistication :  Did  they  possess  skills  commensurate  with  the  plan — such 
as  assembling  a  complex  weapon? 

■  Operational  Proficiency.  Did  those  charged  with  actually  executing  the  attack 
possess  the  ability  to  perform  their  roles  and  to  react  to  unforeseen  circumstances? 

■  Terrorist  Profile  Indicators'.  Were  the  plotters  on  watch  lists,  did  they  have  known 
terrorist  connections,  or  did  they  exhibit  any  other  characteristics  that  would 
normally  lead  to  interest  from  security  services? 

■  Terrorist  OPSEC:  How  well  were  the  plotters  able  to  hide  their  intentions  from 
outsiders? 

■  Innovation'.  Did  the  terrorists  use  a  new  and  innovative  technique? 
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■  Technical  Difficulties :  Did  the  plotters  encounter  technical  difficulties  with  their 
equipment  or  other  aspects  of  their  plan? 

•  Security  Services: 

■  Access:  Was  access  to  the  target  restricted? 

■  Law  Enforcement  or  Intelligence  Knowledge :  How  much  did  security  authorities 
know  about  the  plot? 

■  Security  Environment :  Were  the  legal  and  security  structures  in  the  target  country 
permissive  or  restrictive  for  those  planning  terrorist  acts? 

■  Effective  Information  Sharing  (horizontally  and  vertically)'.  Was  information  passed 
to  different  levels  and  across  jurisdictions? 

■  International  Cooperation :  Was  information  effectively  shared  between  countries? 

■  Observant  Public  and/or  Vigilant  Security  Service :  Were  the  public  reporting 
suspicious  activity?  Do  security  or  law  enforcement  services  take  reports  seriously 
and  act  upon  them? 

These  factors  interact  and  influence  each  other.  For  example,  a  high  number  of  terrorist  profile 
indicators  would  make  it  difficult  for  the  terrorists  to  maintain  OPSEC,  while  increasing  the 
likelihood  that  an  observant  public  and  vigilant  security  services  would  take  note  of  suspicious 
activities.  After  each  case  was  examined  using  the  three  matrices,  the  research  team  determined 
the  “lessons  learned”  that  stood  out  from  the  analysis.  After  all  case  studies  were  analyzed,  the 
team  looked  across  the  cases  for  trends  and  commonalities;  these  informed  the  final  conclusions 
and  policy  recommendations. 
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